Add documentation for pinned Codacy action SHA

[Copilot]

Addresses review feedback on PR #9 requesting better maintainability documentation for the pinned commit SHA in the Codacy workflow.

Changes

• Added inline comments explaining the security rationale for pinning to a specific commit SHA
• Added guidance for updating the pinned version, instructing maintainers to look up and note the corresponding release tag when updating

The comments clarify that the SHA d840f886c4bd4edc059706d09c6a1586111c540b should be updated when bumping versions, and that the corresponding release tag should be documented to aid future updates.

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[JaclynCodes]

5800a5c