ci(security): pin all Actions to SHAs, add dependabot cooldown, fix nosemgrep

[szibis]

What

Supply-chain hardening across CI, clearing the largest bucket of open code-scanning findings.

• Pin all 143 tag-based uses: refs to commit SHAs across 18 workflows (actions/checkout@v7 → @3d3c42e… # v7, etc.), each with a # vN comment so Dependabot's existing actions-minor group keeps them updated.
• Add cooldown: {default-days: 7} to every Dependabot ecosystem (github-actions, gomod, docker) so fresh releases bake before a PR is opened.
• Fix the nosemgrep suppression in scripts/check-vl-ast-coverage.py: it sat several lines above the HTTPSConnection call, but Semgrep only honors it on the match line or the line directly above. Moved inline.

Findings cleared

• 143× yaml.github-actions.security.github-actions-mutable-action-tag
• 3× package_managers.dependabot.dependabot-missing-cooldown
• 1× python.lang.security.audit.httpsconnection-detected

Verification (local, semgrep 1.161.0)

mutable-action-tag:      findings: 0 | files scanned: 18 | errors: 0
dependabot-missing-cooldown: 0 findings
httpsconnection-detected:    0 findings

All workflow YAML + dependabot.yml parse valid; the Python script compiles. SHAs were resolved from each tag via the GitHub API and match the SHAs already pinned elsewhere in the repo.

[github-actions]

PR Quality Report

Compared against base branch main.

Coverage and tests

Signal	Base	PR	Delta
Test count	4793	0	-4793
Coverage	85.1%	0%	-100.0% (regressed)

Compatibility

Track	Base	PR	Delta
Loki API	100.0%	11/11 (100.0%)	0.0% (stable)
Logs Drilldown	100.0%	17/17 (100.0%)	0.0% (stable)
VictoriaLogs	100.0%	11/11 (100.0%)	0.0% (stable)

Performance smoke

Lower CPU cost (ns/op) is better. Lower benchmark memory cost (B/op, allocs/op) is better. Higher throughput is better. Lower load-test memory growth is better. Benchmark rows are medians from repeated samples.

Signal	Base	PR	Delta
QueryRange cache-hit CPU cost	3028.0 ns/op	3038.0 ns/op	+0.3% (stable)
QueryRange cache-hit memory	1184.0 B/op	1184.0 B/op	0.0% (stable)
QueryRange cache-hit allocations	29.0 allocs/op	29.0 allocs/op	0.0% (stable)
QueryRange cache-bypass CPU cost	3251.0 ns/op	3292.0 ns/op	+1.3% (stable)
QueryRange cache-bypass memory	1245.0 B/op	1245.0 B/op	0.0% (stable)
QueryRange cache-bypass allocations	30.0 allocs/op	30.0 allocs/op	0.0% (stable)
Labels cache-hit CPU cost	702.4 ns/op	716.8 ns/op	+2.1% (stable)
Labels cache-hit memory	48.0 B/op	48.0 B/op	0.0% (stable)
Labels cache-hit allocations	3.0 allocs/op	3.0 allocs/op	0.0% (stable)
Labels cache-bypass CPU cost	1266.0 ns/op	1253.0 ns/op	-1.0% (stable)
Labels cache-bypass memory	391.0 B/op	391.0 B/op	0.0% (stable)
Labels cache-bypass allocations	14.0 allocs/op	14.0 allocs/op	0.0% (stable)

State

• Coverage, compatibility, and sampled performance are reported here from the same PR workflow.
• This is a delta report, not a release gate by itself. Required checks still decide merge safety.
• Performance is a smoke comparison, not a full benchmark lab run.
• Delta states use the same noise guards as the quality gate (percent + absolute + low-baseline checks), so report labels match merge-gate behavior.