v4.13.3 release

What's Changed

• chore: pin all GitHub Actions to full-length commit SHAs by @andyzhangx in #1094
• [release-4.13] fix: update csi release tools to fix broken image build due to missing gcb-docker-gcloud image by @andyzhangx in #1096
• fix: set nodeDriverRegistrar.livenessProbe.enabled default to true by @andyzhangx in #1101
• fix: cherry-pick #1102 - correct storageclass annotations and node dnsPolicy in latest chart by @andyzhangx in #1104
• feat: add --timeout flag for node-driver-registrar (cherry-pick to release-4.13) by @andyzhangx in #1107
• fix: correct storageclass annotations and node dnsPolicy in latest chart by @andyzhangx in #1103
• [release-4.13] fix: detect and remount stale NFS mounts in NodePublishVolume by @k8s-infra-cherrypick-robot in #1109
• [release-4.13] fix: use syscall.Chmod to correctly handle setgid/setuid/sticky bits in mountPermissions by @k8s-infra-cherrypick-robot in #1110
• [release-4.13] fix: preserve file timestamps when restoring snapshots via TarUnpack by @k8s-infra-cherrypick-robot in #1120
• [release-4.13] chore: bump Go version to 1.25.10 in trivy workflow by @k8s-infra-cherrypick-robot in #1123
• [release-1.20] fix: CVE-2026-29181 by @andyzhangx in #1124
• [release-4.13] fix: build with go1.26.3 to fix go CVE by @andyzhangx in #1129
• [release-4.13] chore(deps): bump build-image/debian-base from bookworm-v1.0.7 to bookworm-v1.0.8 by @k8s-infra-cherrypick-robot in #1138
• [release-4.13] fix: CVE-2026-35469 by @andyzhangx in #1141
• [release-4.13] chore: bump Go version to 1.25.11 in trivy workflow by @k8s-infra-cherrypick-robot in #1149
• [release-4.13] fix: build with go1.26.4 to fix go CVE by @andyzhangx in #1151
• Update csi-release-tools for release-4.13 by @andyzhangx in #1155
• [release-4.13] fix: prevent liveness-probe port conflict during controller rolling update by @k8s-infra-cherrypick-robot in #1156
• [release-4.13] fix: prevent VolumeSnapshotClass server/share from overriding source volume mount in CreateSnapshot by @k8s-infra-cherrypick-robot in #1159
• doc: cut v4.13.3 release by @andyzhangx in #1160

Full Changelog: v4.13.2...v4.13.3