Add the versions composite action

[azazeal]

This PR adds the versions composite action. It allows callers to get a hold of the pinned tool versions they're interested in, from the .versions file #343 introduced.

It's consumed like this:

steps:
  - uses: smallstep/workflows/.github/actions/versions@main # or a pinned SHA
    id: versions

  - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
    with:
      go-version: ${{ steps.versions.outputs.go }}

  - uses: golangci/golangci-lint-action@ba0d7d2ec06a0ea1cb5fa41b2e4a3ab91d21278a # v9.3.0
    with:
      version: v${{ steps.versions.outputs['golangci-lint'] }}

Additionally, it adds a .gitattributes file to the repository, so that every file is checked out with LF regardless of the GH runner it's executed in.