Fix validate workflow failure by removing forbidden CI authority and pinning Actions by SHA

[Copilot]

The validate GitHub Actions job failed because CI workflow definitions violated DevSecOps policy checks (forbidden authority). Specifically, workflows used tag-based uses: references and ci.yml interpolated ${{ secrets.* }}.

• Workflow policy compliance

  • Updated .github/workflows/ci.yml to remove secret interpolation from the test step env block.
  • Replaced tag-based action refs with full 40-char commit SHA pins.

• Cross-workflow consistency

  • Updated .github/workflows/container-contracts.yml to use the same full-SHA pinning pattern for checkout, setup-python, and setup-uv.

• Regression coverage

  • Added test_workflow_secret_expansion_is_forbidden in tests/test_devsecops_platform.py to ensure ${{ secrets.* }} expansion in workflow text is explicitly rejected.

# before
- uses: actions/checkout@v4
env:
  OPENAI_API_KEY: ${{ secrets.OPENAI_API_KEY }}

# after
- uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
# (secret interpolation removed from workflow step)