chore: pin dependencies to SHA digests for OpenSSF scorecard (#104)

Pin scorecard-action and codeql-action to commit SHA in scorecard.yml.
Pin base images to digest in Dockerfile.redos and Dockerfile.astra.
Replace curl|bash with direct binary download for actionlint.
Remove unused pip install cargo-audit-sarif.

.github/workflows/ci.yml

@@ -37,7 +37,10 @@ jobs:
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       - name: Install actionlint
-        run: bash <(curl -s https://raw.githubusercontent.com/rhysd/actionlint/main/scripts/download-actionlint.bash)
+        run: |
+          ACTIONLINT_VERSION=1.7.12
+          curl -sLO "https://github.com/rhysd/actionlint/releases/download/v${ACTIONLINT_VERSION}/actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz"
+          tar xzf "actionlint_${ACTIONLINT_VERSION}_linux_amd64.tar.gz" actionlint
       - name: Run actionlint
         run: ./actionlint -ignore "shellcheck reported issue" -ignore "SC[0-9]"
 
@@ -116,7 +119,6 @@ jobs:
       - name: Upload cargo-audit results as SARIF
         if: always()
         run: |
-          pip install --quiet cargo-audit-sarif 2>/dev/null || true
           python3 -c "
           import json, sys
           sarif = {