chore(ci): harden security

[gabrielmfern]

Summary by cubic

Hardened GitHub Actions for resend-dotnet by pinning actions, scoping NuGet cache keys, and adding least-privilege permissions, timeouts, and release concurrency. Addresses Linear DEV-655.

• Refactors
  • Pinned actions/checkout, actions/setup-dotnet, and actions/cache to SHAs.
  • Scoped NuGet cache with key: nuget-${{ hashFiles('**/*.csproj','**/packages.lock.json') }} and path: .nuget.
  • Added permissions: contents: read at the CI workflow level; kept contents: write for release.
  • Added timeout-minutes: 30 to CI and Release jobs and concurrency for Release to prevent parallel publishes.

^{Written for commit e492c50. Summary will update on new commits.}

[cubic-dev-ai]

cubic analysis

No issues found across 2 files

Confidence score: 5/5

• Automated review surfaced no issues in the provided summaries.
• No files require special attention.

Linked issue analysis

Linked issue: DEV-655: [resend-dotnet] GH Actions hardening — 1 HIGH / 2 MED / 2 LOW

Status	Acceptance criteria	Notes
✅	Use a hashFiles-based cache key for the NuGet cache to prevent cache poisoning (both CI and release workflows).	Both .github/workflows/ci.yml and .github/workflows/release.yml replace the fixed key with nuget-${{ hashFiles('**/*.csproj','**/packages.lock.json') }}, addressing the cache-poisoning finding.
✅	Declare appropriate top-level permissions for workflows (CI workflow was missing permissions).	ci.yml adds permissions: contents: read; release.yml already had permissions: contents: write, so workflows now declare top-level permissions.
✅	Add a concurrency group for release.yml to avoid concurrent release runs.	release.yml now includes a concurrency block with group: ${{ github.workflow }}-${{ github.ref }} and cancel-in-progress: false.
✅	Add timeout-minutes to jobs that were missing timeouts (two jobs).	Both build jobs in ci.yml and release.yml now include timeout-minutes: 30.

_{Auto-approved: These changes harden CI/CD security by pinning actions to specific SHAs, adding granular permissions, timeouts, and release concurrency, with no impact on application logic or data.}