CI: Pin GitHub Actions and fix zizmor high-severity findings

[CommanderK5]

Description

This PR fixes zizmor --min-severity high findings in our GitHub Actions workflows by:

• Pinning all uses: references to immutable commit SHAs (replaces floating tags like @v6 / @main).
• Pinning internal Terraform setup action usage (coder/coder/.github/actions/setup-tf@main) to a fixed ref/commit.
• Pinning crate-ci/typos to a commit SHA.
• Removing GitHub expression template expansion inside a run: block in version-bump.yaml (prevents template injection flagged by zizmor).

Type of Change

• New module
• New template
• Bug fix
• Feature/enhancement
• Documentation
• Other

Module Information

N/A

Template Information

N/A

Testing & Validation

• Tests pass (bun test)
• Code formatted (bun fmt)
• Changes tested locally - zizmor .github/workflows/* --min-severity high

Related Issues

• fix: enhance version bump workflow to support forked PRs #642
• feat: add zizmor workflow checks for GitHub Actions #662

[jdomeracki-coder]

+1