fix(security): pin all workflow action references to SHA hashes

[Copilot]

• Explore repository and identify all workflow files with non-SHA-pinned action references
• Fix all template, example, and workflow-template files to pin action references to SHA hashes
• Fix dependency-review-config.yml - remove empty allow-licenses: [] that conflicted with deny-licenses

[jdfalk]

@copilot Can you fix this:

2026-04-02T23:02:54.6792464Z ##[group]Run actions/dependency-review-action@2031cfc
2026-04-02T23:02:54.6794311Z with:
2026-04-02T23:02:54.6795257Z config-file: ./.github/dependency-review-config.yml
2026-04-02T23:02:54.6796552Z fail-on-severity: moderate
2026-04-02T23:02:54.6797975Z repo-token: ***
2026-04-02T23:02:54.6798799Z ##[endgroup]
2026-04-02T23:02:55.0008163Z ##[error][
{
"code": "custom",
"message": "You cannot specify both allow-licenses and deny-licenses",
"path": []
},
{
"code": "custom",
"message": "You should provide at least one license in allow-licenses",
"path": []
}
]

[Copilot]

@copilot Can you fix this:

2026-04-02T23:02:54.6792464Z ##[group]Run actions/dependency-review-action@2031cfc...

Fixed in f45d2e3. The dependency-review-config.yml had an empty allow-licenses: [] entry alongside deny-licenses, which the action rejects — you can only use one or the other. Removed the empty allow-licenses field so only deny-licenses is active.