fix(ci): pin reusable workflow actions to SHA, bump to v7 and document the pinning policy

[rajnisht7]

Fixes #30.

• reusable-python-security.yml shipped with a literal # TODO: pin to commit SHA before merge comment on actions/checkout@v4 and actions/setup-python@v5. Both are now pinned to a commit SHA with a version comment. actions/checkout and actions/upload-artifact are also bumped from v4 to v7 to match the version used everywhere else in the org
• Updated docs/security-baseline.md: the old note said third-party actions "must be pinned... currently TODO". Replaced it with the actual policy hence, first-party and third-party actions are both pinned to SHAorg-wide, so it stops drifting per repo

[imran-siddique]

Verified every SHA at source rather than trusting the version comments, since a wrong SHA in a pinning PR is worse than no pin: it looks pinned, passes review, and nobody re-checks it.

pin	tag	result
actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1	v7.0.1	exact
actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065	v5.6.0	exact
actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a	v7.0.1	exact
anchore/sbom-action@e22c389904149dbc22b58101806040fa8d37a610	v0.24.0	exact

Annotated tags dereferenced to their commits where needed, which is the step that makes a codeql-style pin look wrong when it is right.

The permissions change is the part I would have asked for if it were missing. Moving contents: write and id-token: write from workflow scope to job scope narrows them to the job that needs them, so every other job in that file drops to the default. id-token: write in particular is the one worth scoping tightly, since it mints OIDC tokens. Doing that in the same PR as the pinning is coherent rather than scope creep: both are about what a compromised step can reach.

Keeping the # vX.Y.Z comment beside each SHA is what makes this maintainable. A bare SHA is unreadable and gets bumped by someone pasting a newer one without checking what it is. Saying explicitly in the .github note that the SHA and the comment must be updated together is the instruction that keeps them from drifting apart.

Replicating the identical change across ca2a, cmcp and trace-spec as separate PRs rather than one is right for repos that do not share a workflow file. They are byte-identical, which I checked.

Merged.