chore: pin all third-party actions to SHA digests

Pin third-party GitHub Actions to immutable SHA digests to prevent
supply chain attacks via tag force-pushing or branch updates.

Actions pinned:
- trufflesecurity/trufflehog (was @main, now SHA)
- sigstore/cosign-installer@v3.8.1
- docker/setup-buildx-action@v3.12.0
- docker/setup-qemu-action@v3.7.0
- docker/login-action@v3.7.0
- goreleaser/goreleaser-action@v6.4.0
- aquasecurity/trivy-action@0.33.1
- github/codeql-action/upload-sarif@v4.32.1
- golangci/golangci-lint-action@v9.2.0
- docker/setup-compose-action@v1.2.0

Version comments added for maintainability.

.github/workflows/secrets.yaml

@@ -17,6 +17,6 @@ jobs:
         with:
           fetch-depth: 0
           submodules: recursive
-      - uses: "trufflesecurity/trufflehog@main"
+      - uses: "trufflesecurity/trufflehog@b78fbfd8eb982f4802e09a265fb2bc37b3040975" # main
         with:
           extra_args: "--results=verified,unknown"