fix(ci): resolve Rollup build failures and secure GitHub Actions workflows

[willum070]

Here is an updated PR description that includes all the web component refactoring along with the gauntlet of Zizmor security hardening we just completed:

---

Description

This PR fundamentally resolves a critical CI failure related to Vite/Rollup native binaries. Additionally, it contains a comprehensive security hardening of all GitHub Actions workflows to achieve full compliance with the Zizmor security scanner.

🛠️ CI & Rollup Native Binary Fix

• Vite Rollup Resolution: Fixed persistent nightly Playwright test failures caused by missing Linux native binaries (@rollup/rollup-linux-x64-gnu). Updated tests.yml to explicitly pass --include=optional to npm ci and force npm rebuild rollup before execution.

🛡️ Zizmor Security Audit Remediation

Hardened all .github/workflows/*.yml files against industry-standard CI/CD attack vectors:

• Template Injections Mitigated: Eliminated severe bash command-injection risks by securely mapping untrusted GitHub context variables (like github.event.before and step outputs) to intermediate env: variables rather than expanding ${{ }} directly inside run: blocks.
• Pinned Actions: Locked all third-party GitHub Actions (actions/checkout, google-github-actions/auth, etc.) to specific, immutable commit SHAs to prevent upstream supply-chain attacks.
• Unsound Conditions Fixed: Replaced if: | with if: |- across multiline conditions to strip trailing newlines, preventing GitHub Actions from inadvertently evaluating them as "truthy" strings.
• Credential Leakage & Excessive Permissions: Added explicit baseline permissions: contents: read to tests.yml to prevent default privilege escalation. Configured actions/checkout with persist-credentials: false where applicable to prevent GITHUB_TOKEN persistence in local .git/config artifacts.
• Deprecated Node.js Actions: Upgraded actions/cache and google-github-actions/auth to their latest Node 20 architectures to clear known-vulnerable-actions warnings.

Motivation and Context

These updates ensure the codebase aligns with the latest Google Maps Platform declarative web component patterns, stabilizes the nightly CI pipeline, and proactively secures our automated infrastructure against emerging GitHub Actions vulnerabilities.