Pin GitHub Actions to SHAs [SRE-1802]

[tylergohl]

Summary

Pin GitHub Actions references in this repo to immutable commit SHAs (with the original tag/branch preserved in a trailing comment). Part of SRE-1802 — org-wide supply-chain hardening.

Scope

This PR pins:

• Internal ctrliq/* reusable workflow and action references
• External actions not handled by clo-ciq's parallel Node 20 effort

Deferred to clo-ciq (see #17): actions/checkout, actions/setup-go.
Those will be SHA-pinned by clo's PR; this PR intentionally leaves them alone to avoid merge conflicts.

Files touched

• .github/workflows/test.yaml

Test plan

• Workflow runs succeed on this branch (or on next trigger after merge)
• Once this and any companion clo-ciq PR merge, this repo has zero unpinned external/internal refs and sha_pinning_required can be enabled on it

[Copilot]

Pull request overview

Supply chain hardening for GitHub Actions by pinning action references to immutable commit SHAs (SRE-1802).

Changes:

• Pinned golangci/golangci-lint-action in the test workflow to a specific commit SHA (with the v8 tag retained as an inline comment).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.