Update codeql-action/upload-sarif SHA for v3 tag

[Copilot]

The TestActionPinSHAsMatchVersionTags test was failing because the stored SHA for github/codeql-action/upload-sarif@v3 no longer matched the actual commit SHA in the repository.

Changes

• Updated SHA in .github/aw/actions-lock.json from fb2a9d4376843ba94460a73c39ca9a98b33a12ac to 901f0fdebfadabaa0664a07bd572cbd2ff90b07e
• The build process automatically syncs this to pkg/workflow/data/action_pins.json which is embedded in the binary

The v3 tag was moved to a new commit by the upstream repository, requiring our pinned SHA to be updated.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/user
  • Triggering command: gh api user --jq .login (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

Fix tests

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Pull Request Overview

This PR fixes a failing test by updating the pinned SHA for github/codeql-action/upload-sarif@v3 after the upstream v3 tag was moved to a new commit. It also adds missing output declarations to the glossary-maintainer workflow.

Key Changes

• Updated the SHA for github/codeql-action/upload-sarif@v3 from fb2a9d4376843ba94460a73c39ca9a98b33a12ac to 901f0fdebfadabaa0664a07bd572cbd2ff90b07e
• Added comment_id and comment_repo output declarations to the glossary-maintainer workflow's activation job to satisfy downstream references

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/aw/actions-lock.json	Updated SHA for codeql-action/upload-sarif@v3 to match the current v3 tag
pkg/workflow/data/action_pins.json	Mirror of actions-lock.json with the same SHA update (auto-synced during build)
.github/workflows/glossary-maintainer.lock.yml	Added missing output declarations (empty strings) that are referenced by downstream jobs but were previously undefined

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.