chore(vuln): pin and bump action refs (SEC-171) (#135)

## What

Deterministic remediation of four zizmor audit rules:

- `known-vulnerable-actions` — bumps vulnerable refs to the GHSA
advisory's `first_patched_version`, re-pins to SHA, syncs the version
comment.
- `unpinned-uses` — rewrites `@tag` refs to `@<sha> # <tag>`.
- `ref-version-mismatch` — rewrites the trailing comment to match the
tag the pinned SHA actually points at.
- `impostor-commit` — replaces the impostor SHA with the correct SHA for
the tag.

All edits are SHA-pinned ref rewrites plus comment synchronisation. No
workflow logic, step ordering, permissions, or non-`.github/` files are
touched.

## How

1. `zizmor --fix=all` run under a restricted config
(`sec-scan/sec-ops/sec-171-action-refs/zizmor.yml`) that disables every
other audit.
2. A Python post-processor (`postprocess.py`) repairs any line where
zizmor's auto-fix left the ref unpinned — an observed failure mode on
certain impostor-commit cases. The post-processor resolves the tag → SHA
via `gh api` and rewrites the line.
3. Two sanity guards run before commit:
   - `git diff --name-only` must only contain paths under `.github/`.
   - Every added `uses:` line must match `owner/repo@<40-hex-sha>`.

## ⚠️ Merge blocker — SHA allowlist

**Do NOT merge this PR until the new SHAs have been added to the
org-level GitHub action allowlist.** The rudderlabs org enforces a
by-SHA allowlist on all `uses:` references (supply-chain guard). Every
SHA introduced by this PR is captured in `/tmp/sec-171-sha-manifest.txt`
on the machine that produced the sweep; the allowlist will be updated by
@aris1009 before merge coordination.

## Ticket

Closes part of [SEC-171](https://linear.app/rudderstack/issue/SEC-171) —
parent epic [SEC-162](https://linear.app/rudderstack/issue/SEC-162).

Author: aris1009

.github/workflows/build-and-quality-checks.yml

@@ -11,7 +11,7 @@ jobs:
 
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
@@ -98,4 +98,4 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}  # Needed to get PR information, if any
           SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}
-        run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=rudderlabs_rudder-sdk-java
+        run: mvn -B verify org.sonarsource.scanner.maven:sonar-maven-plugin:sonar -Dsonar.projectKey=rudderlabs_rudder-sdk-java

.github/workflows/check-pr-title.yml

@@ -10,12 +10,12 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Harden the runner (Audit all outbound calls)
-        uses: step-security/harden-runner@f4a75cfd619ee5ce8d5b864b0d183aff3c69b55a # v2.13.1
+        uses: step-security/harden-runner@5ef0c079ce82195b2a36a210272d6b661572d83e # v2.14.2
         with:
           egress-policy: audit
 
       - name: Checkout source branch
         uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Check PR title
-        uses: rudderlabs/github-action-check-pr-title@29308e12984bdb3f3dcf8dcec3308f4f4652529c # v1.0.7
+        uses: rudderlabs/github-action-check-pr-title@29308e12984bdb3f3dcf8dcec3308f4f4652529c # v1.0.7