Enhance reusable workflows

[Yaswant Pradhan (yaswant)]

PR Summary

Code Reviewer: James Bruten (@james-bruten-mo)

Hardens the GitHub Actions security baseline across all workflows.

Action pinning

• All third-party actions replaced with immutable 40-char commit SHAs (e.g. actions/checkout@v6 → @df4cb1c…).
• actions/github-script in track-review-project.yaml upgraded from v8 → v9 as part of the pin.

Credential & permission scoping

• persist-credentials: false added to every actions/checkout step
• Top-level permissions: {} set on caller workflows; granular contents: read / pull-requests: write / actions: read pushed down to job level in call-track-review-project.yaml, call-trigger-project-workflow.yaml, and trigger-project-workflow.yaml
• fortran-lint.yaml gains an explicit contents: read job permission.

Template-injection fixes (zizmor)

• cla-check.yaml: step outputs and inputs.cla-url moved to env: vars, read via process.env.* in the github-script block.
• fortran-lint.yaml: all string/path inputs moved to env: vars; boolean flags resolved in shell using a bash array.
• track-review-project.yaml: inputs.project_org and inputs.project_number moved to env: vars. Also, included PROJECT_ACTION_PAT secret as required parameter to avoid secret inheritance in caller workflow (breaking change! See updated README for usage).

CLA workflow logic

• Merge-ref detection replaced: git ls-remote → gh api repos/.../pulls/… (avoids unauthenticated git network call).
• CONTRIBUTORS.md modification check rewritten: git diff → GitHub Contents API + base64 | tr | cmp (avoids authenticated git fetch from fork). File modification now checked against content instead of just file state.

Tooling & config

• New dependabot.yaml: monthly schedule, major-version updates blocked, all action updates grouped into a single PR
• New zizmor.yaml: suppresses unpinned-uses, dangerous-triggers, and secrets-inherit for the two caller workflows that use secrets: inherit
• .yamllint: updated ignore syntax; added comments and comments-indentation rules.
• PR template: minor formatting tidy-up, emoji section headers, few typo fixes.

To enforce strict GitHub Actions security baselines, we now use immutable 40-character commit SHAs.

• closes Security hardening: Pin third-party actions to immutable commit SHAs #79

✅ Code Quality Checklist

(Some checks are automatically carried out via the CI pipeline)

• I have performed a self-review of my own code
• My code follows the project's style guidelines
• The modified workflow's README has been updated, if required
• The changes have been sufficiently tested (see MetOffice/git_playground/pull/137)

🤖 AI Assistance and Attribution

• Some of the content of this change has been produced with the assistance of Generative AI tool name (e.g., Met Office Github Copilot Enterprise, Github Copilot Personal, ChatGPT GPT-4, etc) and I have followed the Simulation Systems AI policy (including attribution labels)

💻 Code Review

• The changes are approriate and testing has been sufficient