docs: add pinned-by-SHA usage example to README

Addresses review feedback on PR #538 by documenting the recommended
practice of pinning the action to a full commit SHA for supply-chain
security, in line with GitHub's hardening guidance.

Author: bosesuneha

README.md

@@ -147,6 +147,21 @@ Following are the key capabilities of this action:
 
 ## Usage Examples
 
+### Pinning the action version
+
+For supply-chain security, GitHub [recommends](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions) pinning third-party actions to a full-length commit SHA rather than a mutable tag. The examples below use `Azure/k8s-deploy@v7` for readability, but the pinned form is preferred in production workflows:
+
+```yaml
+# Pinned to a specific commit SHA (recommended)
+- uses: Azure/k8s-deploy@<full-commit-sha> # v7.0.0
+  with:
+     manifests: |
+        deployment.yaml
+        service.yaml
+```
+
+Replace `<full-commit-sha>` with the 40-character commit SHA of the [release](https://github.com/Azure/k8s-deploy/releases) you want to pin to. Dependabot can keep pinned SHAs up to date automatically — see [Keeping your actions up to date with Dependabot](https://docs.github.com/en/code-security/dependabot/working-with-dependabot/keeping-your-actions-up-to-date-with-dependabot).
+
 ### Basic deployment (without any deployment strategy)
 
 ```yaml