Add pinact and zizmor workflow checks

[demeyerthom]

Summary

• Pin all GitHub Actions to full-length commit SHAs using pinact
• Add pinact and zizmor workflow checks for CI
• Fix template injection vulnerabilities in release workflow by using environment variables instead of direct template expansion