feat(pr-comment): capture pull_request.base.sha as base_sha

[reuvenharrison]

Summary

The pr-comment action now extracts pull_request.base.sha from the GitHub event payload and propagates it in two places:

1. Free-review URL annotation (::notice::): uses the base SHA instead of the branch name. The link is now commit-pinned and stays valid even if the base branch advances after the PR was opened.
2. JSON payload to oasdiff-service: gains a github.base_sha field alongside the existing github.base_ref. The service stores it on the report so the review page can show the exact base content oasdiff compared against, rather than chasing whatever the base branch happens to point at when the reviewer opens the page.

base_ref is preserved for backward compatibility with reports stored before this field existed, and for the rare case where pull_request.base.sha is empty in the event payload.

Why

The review page's side-by-side viewer renders content fetched from raw.githubusercontent.com/<owner>/<repo>/<ref>/<file>. When <ref> is a branch name like main, the content can drift between when the PR was opened and when the reviewer opens it. Pinning to the base commit SHA fixes that.

Test plan

• Trigger the action on a PR. Check the workflow log for the ::notice:: line — confirm the URL contains a 40-char SHA, not a branch name, in the base_sha= query parameter.
• Inspect the JSON payload submitted to oasdiff-service (visible in step output) — confirm it has a github.base_sha field with the same SHA.
• Open the resulting review page and confirm it still loads correctly (depends on oasdiff-service merging the companion PR that accepts the new field; until then, the field is ignored, no regression).