DEVOPS-1133: Pin version to hash

[RomFloreani]

DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every uses: to a commit hash with a dependabot-readable version comment.

Tags expanded in this repo:

• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-static_analysis.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-pytest.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 -> @v3.12.0

Workflows added:

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/wip-status.yml

All MiraGeoscience/CI-tools reusable workflows are pinned to 7241532854727d993872b67fc761139b8438615b (v3.12.0).

[Copilot]

Pull request overview

Pins all referenced reusable GitHub workflows from MiraGeoscience/CI-tools to an immutable commit SHA (matching v3 / v3.9.1) to reduce supply-chain risk and improve build reproducibility.

Changes:

• Updated Zizmor security scan reusable workflow references to a commit hash.
• Updated Python analysis and deploy reusable workflow references to a commit hash.
• Updated JIRA automation reusable workflow references to a commit hash.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/security_scan.yml	Pins Zizmor reusable workflows to a specific CI-tools commit SHA.
.github/workflows/python_deploy_prod.yml	Pins production Python release reusable workflows to a specific CI-tools commit SHA.
.github/workflows/python_deploy_dev.yml	Pins development Python publish reusable workflows to a specific CI-tools commit SHA.
.github/workflows/python_analysis.yml	Pins Python static analysis and pytest reusable workflows to a specific CI-tools commit SHA.
.github/workflows/pr_jira_actions.yml	Pins PR→JIRA reusable workflow to a specific CI-tools commit SHA.
.github/workflows/issue_to_jira.yml	Pins issue→JIRA reusable workflow to a specific CI-tools commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.79%. Comparing base (37d55a4) to head (cf61771).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop     #131   +/-   ##
========================================
  Coverage    92.79%   92.79%           
========================================
  Files           27       27           
  Lines         1526     1526           
========================================
  Hits          1416     1416           
  Misses         110      110           

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.