Github action fixes - #3659

Prevent the GitHub token from being persisted in the git config
after checkout. This avoids potential credential leakage through
artifacts or subsequent steps that don't need repository access.

Reported by zizmor (artipacked).

Apply the principle of least privilege by adding explicit permissions
blocks to every job that was relying on default (overly broad)
permissions. Each job now declares only the permissions it needs.

Reported by zizmor (excessive-permissions).

Replace ${{ env.* }} expressions in shell run blocks with native
shell variable references ($VAR), and pass ${{ github.base_ref }}
through an env variable instead of expanding it directly in a shell
command. This prevents potential code injection through template
expansion.

Reported by zizmor (template-injection).

Pin all third-party action references to their full commit SHA to
prevent supply-chain attacks through tag manipulation. A version
comment is added after each SHA for maintainability.

Reported by zizmor (unpinned-uses).

Add inline zizmor ignore comments for secrets used outside a
dedicated GitHub Environment. Fixing this properly requires
external repository configuration (creating a GitHub Environment)
which cannot be done from code alone.

Reported by zizmor (secrets-outside-env).

The hold job has zero permissions, no secrets access, and no code
checkout, so the privileged pull_request_target trigger is
unnecessary. The merge_group trigger remains as the tamper-proof
gate for the merge queue.

Reported by zizmor (dangerous-triggers).

The pull_request_target trigger is required here to access secrets
for the backport bot token. The workflow is safe: it only runs on
merged PRs (github.event.pull_request.merged guard), does not
checkout or execute any PR code, and uses a dedicated GitHub App
token for creating backport PRs.

Reported by zizmor (dangerous-triggers).

Extract the semver analysis (checkout, rebase, go-apidiff) into a
new semver.yaml workflow triggered by pull_request, which runs in
the unprivileged fork context. The privileged labeling logic stays
in label-pr.yaml as a new semver-label job triggered by workflow_run
on completion of the analysis. PR number and base ref are resolved
via the GitHub API from the workflow_run head SHA.

The edits job (actions/labeler) remains on pull_request_target with
an event_name guard. Both triggers are suppressed with inline
comments: neither job checks out or executes PR code.

Reported by zizmor (dangerous-triggers).

Run zizmor on pushes to master and pull requests that modify
workflow files. Results are uploaded as SARIF to GitHub's
security-events API for code scanning integration.