BUG - False positive on Pinned-Dependencies check when commit SHA is used with "# main" comment

**Describe the bug** Scorecard's Pinned-Dependencies check produces false positives when GitHub Actions workflows use specific commit SHAs but include comments like `# main` after the SHA. The tool incorrectly interprets these as floating references rather than pinned dependencies. **Reproduction steps** 1. Create a GitHub Actions workflow that uses a specific commit SHA 2. Add a comment after the SHA indicating the branch it came from (e.g., `# main`) 3. Run Scorecard analysis on the repository 4. Observe that Scorecard flags this as an unpinned dependency