fix: pin GitHub Actions to commit SHAs to prevent supply-chain attacks

[vinayada1]

Replaces mutable version tags with immutable commit SHA references for all first-party GitHub Actions (actions/checkout, actions/setup-go, actions/upload-artifact) across 5 workflow files. Dependabot is already configured for github-actions and will automatically propose SHA updates when new versions are released.

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply chain by replacing mutable action version tags with immutable commit SHAs across the affected workflows.

Changes:

• Pin actions/checkout to a commit SHA in all impacted workflows.
• Pin actions/setup-go to a commit SHA in CI and lint workflows.
• Pin actions/upload-artifact to a commit SHA in the OSPS security assessment workflow.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/security-insights.yml	Pins actions/checkout to an immutable commit SHA.
.github/workflows/post-merge.yml	Pins actions/checkout to an immutable commit SHA.
.github/workflows/osps-security-assessment.yml	Pins actions/checkout and actions/upload-artifact to immutable commit SHAs.
.github/workflows/lint.yml	Pins actions/checkout and actions/setup-go to immutable commit SHAs.
.github/workflows/ci.yml	Pins actions/checkout and actions/setup-go to immutable commit SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[eddie-knight]

This is a good improvement, thanks @vinayada1

nacking for caution, as @jmeridth or I will need to manually verify every SHA prior to merge (complaints may be issued to GitHub who allow malicious commits to be affiliated with official repos)

[jmeridth]

Thank you for doing this. I agree with this PR but for historical context these actions have immutable releases. So the content at those tags can't change. Hence them not being a priority but this is the better "visible" practice.

• Confirmed Checkout SHA
• Confirm Setup Go SHA
• Confirmed Upload Artifact SHA

@vinayada1 some conflicts to fix and copilot suggestions. Some of the copilot suggestions are not correct, beware. I've handled the invalid copilot comments.