Add checksum verification input

[illera88]

Summary

Supply chain attacks are lately one of the most practical ways to compromise CI: an action can be pinned, but the binary it downloads at runtime can still change upstream. Adding a checksum input lets users pin both the action code and the downloaded release asset, so workflows fail closed if that binary is replaced, corrupted, or unexpectedly modified.

• add an optional checksum input
• verify the downloaded buf archive or executable before extracting and caching it
• update the bundled action and README

Why

This action downloads a release binary during CI. Pinning the action SHA fixes the action code, but it does not pin the release asset that gets fetched later. A checksum input gives security-sensitive workflows a simple way to make that binary download fail closed if the asset changes unexpectedly.

Testing

• npm run types-check
• npm run build
• npm run lint

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[pkwarren]

This action is deprecated and replaced with buf-action.

To migrate to buf-action, see: https://github.com/bufbuild/buf-action/blob/main/MIGRATION.md