chore(deps): pin dependencies

[renovate-sh-app]

This PR contains the following updates:

Package	Type	Update	Change
actions/checkout	action	pinDigest	-> f43a0e5
actions/setup-go	action	pinDigest	-> 19bb512
actions/setup-go	action	pinDigest	-> be3c94b
goreleaser/goreleaser-action	action	pinDigest	-> 5fdedb9

---

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.

---

• If you want to rebase/retry this PR, check this box

---

Need help?

You can ask for more help in the following Slack channel: #proj-renovate-self-hosted. In that channel you can also find ADR and FAQ docs in the Resources section.

[github-actions]

😢 zizmor failed with exit code 14.

Expand for full output

error[cache-poisoning]: runtime artifacts potentially vulnerable to a cache poisoning attack
  --> ./.github/workflows/release.yml:16:9
   |
 3 | / on:
 4 | |   push:
 5 | |     tags:
 6 | |       - 'v[0-9]+.[0-9]+.[0-9]+'
   | |_______________________________- generally used when publishing artifacts generated at runtime
...
16 |         - uses: actions/setup-go@19bb51245e9c80abacb2e91cc42b33fa478b8639 # v4
   |           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ cache enabled by default here
   |
   = note: audit confidence → Low
   = note: this finding has an auto-fix

9 findings (4 ignored, 4 suppressed, 1 fixable): 0 informational, 0 low, 0 medium, 1 high