DEVOPS-1133: Pin version to hash

[RomFloreani]

DEVOPS-1133 - pin all GitHub actions and reusable workflows to hash
Expands moving GitHub Actions tags to the full semver tag pointing at the same commit, then pins every uses: to a commit hash with a dependabot-readable version comment.

Tags expanded in this repo:

• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-issue_to_jira.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-jira-pr_actions.yml@v3 -> @v3.12.0
• actions/checkout@v4 -> @v4
• actions/setup-python@v5 -> @v5
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_rattler_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-publish_pypi_package.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_conda_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-python-release_pypi_assets.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-advanced-security.yml@v3 -> @v3.12.0
• MiraGeoscience/CI-tools/.github/workflows/reusable-zizmor-annotate.yml@v3 -> @v3.12.0

Workflows added:

• .github/workflows/dependabot-auto-merge.yml
• .github/workflows/wip-status.yml

All MiraGeoscience/CI-tools reusable workflows are pinned to 7241532854727d993872b67fc761139b8438615b (v3.12.0).

[Copilot]

Pull request overview

This pull request updates SimPEG’s GitHub Actions workflows to pin the referenced MiraGeoscience/CI-tools reusable workflows to an immutable commit SHA (instead of @v3), improving supply-chain security and reproducibility.

Changes:

• Pinned CI-tools reusable workflow references from @v3 to a specific commit SHA (89672b...) across multiple workflows.
• Added inline version comments (# v3.9.1) alongside the pinned hashes for traceability.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
.github/workflows/security_scan.yml	Pins zizmor reusable workflows to a commit SHA.
.github/workflows/python_deploy_prod.yml	Pins production publish reusable workflows (Conda/PyPI) to a commit SHA.
.github/workflows/python_deploy_dev.yml	Pins development publish reusable workflows (Conda/PyPI) to a commit SHA.
.github/workflows/pr_jira_actions.yml	Pins JIRA PR actions reusable workflow to a commit SHA.
.github/workflows/issue_to_jira.yml	Pins JIRA issue creation reusable workflow to a commit SHA.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.

[github-actions]

⚠️ Force push detected - Previous Copilot review comments may no longer be relevant to the current code. Please resolve any outdated threads and re-request a Copilot review when ready.