ensure at least one test uses action without a checkout

[jku]

#256 showed how our testing wasn't fool proof: every test that uses the action works something like this

- uses: actions/checkout
- uses: ./

I would like it if there was a test that did not require actions/checkout as that pollutes the current working directory with content that actual users will not have. It's not really possible to do this in a PR but we could maybe still do a test with

- uses: sigstore/gh-action-sigstore-python@main
  if: github.event_name != 'pull_request' && github.repository == 'sigstore/gh-action-sigstore-python'