ci: repin Secure Runner workflows

[sds]

Summary

• repin every existing Secure Runner first step to the latest validated gh-actions commit
• preserve the shared Dependency Scan and Scan GitHub Actions workflows merged in ci: adopt shared security scans #42
• preserve existing job permissions and workflow behavior

Validation

• parsed every workflow with yq
• verified every ordinary job starts with Secure Runner at the exact latest pin
• verified every ordinary job retains effective id-token: write
• git diff --check