chore: harden GitHub Actions workflows

[jonathan343]

Overview

This PR hardens several GitHub Actions workflows to resolve zizmor findings around action pinning, token scope, credential persistence, and shell template expansion.

I highly recommend the team considers the following:

• Configure Dependabot for github-actions to keep actions up to date.
• Implement a mechanism to prevent regressions. This can be done through configuring zizmor as a pre-commit hook or integrating it into your CI. Note: The awslabs org has some limitations against third-party actions so avoid using zizmor-action for now.

Summary

• Pins GitHub Actions uses: references to full commit SHAs while retaining version comments for readability.
• Sets persist-credentials: false on actions/checkout steps that do not need persisted Git credentials.
• Scopes id-token: write down from the workflow level to only the jobs that assume an AWS role in integration-test.yml, instead of granting it to every job in the workflow.
• Replaces ${{ inputs.* }} interpolation inside run: blocks of the checkout-smithy-swift-composite-action with env:-passed variables to prevent shell template-injection.
• Adds a 7-day Dependabot cooldown for the existing gitsubmodule updater so new releases bake before being proposed.

These changes address the relevant zizmor audit guidance for unpinned-uses, excessive-permissions, artipacked, and template-injection.

---

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.