[v2] Github action fixes - #3673

Prevent the GITHUB_TOKEN from being persisted in the local git
config after checkout. This limits the blast radius if a
subsequent step is compromised, since the token will not be
available through the git credential helper.

Reported by zizmor (artipacked).

Apply the principle of least privilege by adding explicit permissions
blocks to every job that was relying on default (overly broad)
permissions. Each job now declares only the permissions it needs.

Reported by zizmor (excessive-permissions).

Replace ${{ env.* }} expressions in shell run blocks with native
shell variable references ($VAR), and pass ${{ github.base_ref }}
through an env variable instead of expanding it directly in a shell
command. This prevents potential code injection through template
expansion.

Reported by zizmor (template-injection).

Replace mutable version tags with immutable commit SHA references
for all GitHub Actions used in workflows. This prevents a
compromised or hijacked action tag from injecting malicious code
into CI runs.

Reported by zizmor (unpinned-uses).

The backport bot token action requires secrets to be passed through
the 'with' block (not environment variables) because it's a
composite action input. Add zizmor ignore comments to suppress the
false-positive warnings.

Reported by zizmor (secrets-outside-env).

This workflow only reads label metadata from the event payload and
does not need write access to the repository. Using pull_request
instead of pull_request_target avoids granting unnecessary elevated
privileges.

Reported by zizmor (dangerous-triggers).

The backport workflow legitimately uses pull_request_target because
it needs write access to create backport PRs. It is safe because it
only runs on merged PRs (guarded by an if condition) and never
checks out or executes PR code.

Reported by zizmor (dangerous-triggers).

Move the Go API compatibility analysis (semver check) into a
separate 'Semver analysis' workflow that runs on the unprivileged
pull_request trigger. The label-pr workflow now picks up the results
via a workflow_run trigger, which only fires after the analysis
completes. This eliminates the need for pull_request_target in the
semver analysis, removing the dangerous-triggers finding.

The semver-label job uses the GitHub API to look up the PR number
from the head commit SHA, then applies the appropriate semver and
backport labels.

Reported by zizmor (dangerous-triggers).

The commits/:sha/pulls API endpoint does not return results for
fork PRs because the commit does not exist in the base repository.
Instead, include the PR number and base ref in the artifact
uploaded by the semver analysis workflow, where they are always
available from the pull_request event context.

This fixes up commit 609db9c.

Dependabot reads its configuration from the default branch (main)
only. Having a copy on v2 is unnecessary and potentially confusing.

This workflow was already removed from the main branch. The
first-interaction greeting bot is no longer needed since the
repository now uses issue and PR templates to guide contributors.

This also resolves the last zizmor dangerous-triggers finding.