Add strict-flake-inputs validation module for 0.10.0

Summary

• Adds new strict-flake-inputs validation module
• Validates that all direct flake inputs point to protected branches or tags
• Only checks direct dependencies, not transitive dependencies
• Configurable via strict-flake-inputs.enable = true (disabled by default)
• Default allowed refs: refs/tags/, refs/heads/lts/, refs/heads/master, refs/heads/main
• Import via inputs.gitlab-ci.modules.gitlab-ci.strict-flake-inputs

Changes

• Created nix/modules/strict-flake-inputs.nix with validation logic
• Updated ChangeLog.md for version 0.10.0
• Updated README.md with usage documentation and examples

🤖 Generated with Claude Code