fix: address review feedback

- Use checkout@v6 for consistency with other workflows
- Pin mcp-conformance-action to SHA for security

Author: SamMorrowDrums

.github/workflows/conformance.yml

@@ -12,12 +12,12 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        uses: actions/checkout@v6
         with:
           fetch-depth: 0
 
       - name: Run MCP Conformance Test
-        uses: SamMorrowDrums/mcp-conformance-action@v1
+        uses: SamMorrowDrums/mcp-conformance-action@b5c958a5a80d5708b68dec3b69a8c1bb8a5189df # v1
         with:
           setup_go: "true"
           install_command: go mod download