fix: correct hash-pin version comments in GitHub Actions workflows

Fix all 7 ref-version-mismatch findings from zizmor audit:

- lint.yml (3x): fix golangci-lint-action comment from 9.2.0 to v9.2.0
- scorecards.yml (2x): fix scorecard-action comment from v2.3.1 to v2.4.0
  and upload-artifact comment from v3.1.3 to v4.3.3 (hashes were already
  correct, comments were stale)
- release.yaml: re-pin cosign-installer from a main branch commit to
  v3.2.0 (the closest stable tag after the pinned commit from Sept 2023)
- test.yml: re-pin ent/contrib/ci from a master branch commit to v0.5.0
  (the closest stable tag after the pinned commit from Sept 2023)

Assisted-by: Claude Code
Signed-off-by: Miguel Martinez Trivino <miguel@chainloop.dev>

Author: migmartri

.github/workflows/lint.yml

@@ -34,14 +34,14 @@ jobs:
           go-version-file: 'go.mod'
 
       - name: Lint main module
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         if: ${{ matrix.app == 'main-module' }}
         with:
           version: v2.9.0
           only-new-issues: 'true'
 
       - name: Lint ${{ matrix.app }}
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         if: ${{ matrix.app != 'main-module' }}
         with:
           working-directory: app/${{ matrix.app }}
@@ -84,7 +84,7 @@ jobs:
           make -C extras/dagger module-init
 
       - name: Lint
-        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # 9.2.0
+        uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
         with:
           working-directory: extras/dagger
           version: v2.9.0

.github/workflows/release.yaml

@@ -61,7 +61,7 @@ jobs:
 
     steps:
       - name: Install Cosign
-        uses: sigstore/cosign-installer@ef6a6b364bbad08abd36a5f8af60b595d12702f8 # main
+        uses: sigstore/cosign-installer@1fc5bd396d372bee37d608f955b336615edf79c8 # v3.2.0
         with:
           cosign-release: "v2.2.3"
 

.github/workflows/scorecards.yml

@@ -47,7 +47,7 @@ jobs:
           persist-credentials: false
 
       - name: "Run analysis"
-        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.3.1
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
         with:
           results_file: results.sarif
           results_format: sarif
@@ -69,7 +69,7 @@ jobs:
       # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
       # format to the repository Actions tab.
       - name: "Upload artifact"
-        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v3.1.3
+        uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
         with:
           # When downloading if not name is set the artifact name will be "artifact"
           # We need to specify the name to download it later

.github/workflows/test.yml

@@ -53,7 +53,7 @@ jobs:
 
       # Check that the generated ent code is up to date
       # see https://entgo.io/docs/ci/
-      - uses: ent/contrib/ci@e38dfb6484dfbe64b8bd060fe6a219a1aa5da770 # master
+      - uses: ent/contrib/ci@4ec197664a206890a44245f5c0cbcb8110d68cb5 # v0.5.0
         name: "Check all ent generated code is checked in"
         if: ${{ matrix.app != 'main-module' }}
         with: