fix(ci): resolve zizmor security findings in GitHub Actions workflows

[rohityan]

This PR resolves 58 security and workflow linting findings identified by zizmor across 13 GitHub Actions workflow files.

Summary of Fixes Applied

• artipacked (15 instances): Added persist-credentials: false to all actions/checkout steps.
• unpinned-uses (18 instances): Pinned third-party and GitHub action references to explicit 40-character commit SHAs.
• ref-version-mismatch (9 instances): Updated version comments to match exact release tags (# v6.0.3, # v6.2.0, # v6.4.0).
• template-injection (12 instances): Replaced inline ${{ ... }} expression expansions in run: scripts with step-level env: variables.
• excessive-permissions (2 instances): Added explicit permissions: blocks to block-merge.yml and issue-maintenance.yml.
• dangerous-triggers (1 instance): Scoped permissions and avoided untrusted head code execution on pull_request_target in pr-triage.yml.
• use-trusted-publishing (1 instance): Added id-token: write permission for PyPI Trusted Publishing in release-publish.yml.