Scharf: A fast SAST tool to fix GitHub Actions supply chain risks