chore: harden GitHub Actions workflows

[jonathan343]

Overview

This PR hardens several GitHub Actions workflows in aws-sdk-php to resolve zizmor findings around action pinning, credential persistence, and shell template expansion.

I highly recommend the team considers the following:

• Implement a mechanism to prevent regressions. This can be done through configuring zizmor as a pre-commit hook or integrating it into your CI. Note: The aws org has some limitations against third-party actions so avoid using zizmor-action for now.

Summary

• Pins GitHub Actions uses: references to full commit SHAs while retaining version comments for readability.
• Sets persist-credentials: false on actions/checkout steps that do not need persisted Git credentials.
• Routes attacker-controlled or context-derived values through env: instead of inlining ${{ ... }} inside run: blocks to avoid shell template expansion.
• Adds cooldown.default-days: 7 to the existing github-actions Dependabot config.

These changes address the relevant zizmor audit guidance for unpinned-uses, excessive-permissions, and template-injection.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.