chore: pin GitHub Actions to commit SHAs

[lvandenboom]

Summary of changes

• Pins GitHub Actions and reusable workflow references to full-length commit SHAs, per GitHub's secure-use guidance for third-party actions. SHA-pinned refs carry a trailing comment with the original tag/branch for readability.
• Also retargets the publish job from the shared publish.yml to release-pipeline.yml (the documented replacement) so manual npm publishes pass the version-type input correctly again. The previous publish.yml was repurposed to a publish-only workflow that no longer accepts version-type, which broke release runs.

Checklist

• Added a changelog entry
• Relevant test coverage
• Tested and confirmed flows affected by this change are functioning as expected

Authors

List GitHub usernames for everyone who contributed to this pull request.

Reviewers

@braintree/team-sdk-js

[github-actions]

Dependency Review

The following issues were found:

• ✅ 0 vulnerable package(s)

See the Details below.

Scanned Files

• .github/workflows/security.yml

[GoogilyBoogily]

👍 🐸