Pin GitHub Actions to full commit SHAs

[Copilot]

Pin all mutable tag-based action refs to immutable 40-char commit SHAs to prevent supply-chain attacks where a tag could be silently redirected.

• .github/workflows/validate-owasp-metadata.yaml: actions/checkout@v6 → pinned SHA # v6.0.2
• .github/workflows/pr_comment.yml: actions/github-script@v9 → pinned SHA # v9.0.0

# Before
uses: actions/checkout@v6

# After
uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

owasp/nest-schema action was already SHA-pinned; no change needed.

[kingthorin]

@copilot the branch has been rebased. Double check your changes per the original requirement.

[Copilot]

@copilot the branch has been rebased. Double check your changes per the original requirement.

Checked after the rebase. The new base commit (a6c674b) updated both workflow files but still had the mutable tag refs. My pinning commit (c46dccf) sits on top and correctly pins both remaining non-SHA refs:

• actions/checkout@v6 → actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
• actions/github-script@v9 → actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9

owasp/nest-schema action remains already SHA-pinned. No further changes needed.

[kingthorin]

@copilot comments should use full semver ex # v9.0.0 vs # v9 (or whatever the actual valid values are)

[Copilot]

@copilot comments should use full semver ex # v9.0.0 vs # v9 (or whatever the actual valid values are)

Updated in commit 4c18e1b:

• actions/checkout → # v6.0.2
• actions/github-script → # v9.0.0