Pin GHA dependencies to SHAs

[zpao]

I flipped this option on the repo for improved security, so need to actualy have them pinned.

Also added yaml files to formatting pass

[Copilot]

Pull request overview

This PR improves GitHub Actions supply-chain security by pinning workflow action dependencies to immutable commit SHAs, and updates the formatting script to include .yml files so workflow YAML can be included in the formatting pass.

Changes:

• Pin all GitHub Actions uses: references in CI, CodeQL, and Scorecard workflows to specific commit SHAs.
• Apply a small YAML formatting pass (quoting/spacing) across the workflow files.
• Extend the pretty script to format .yml files via Prettier.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
package.json	Updates the Prettier glob to include .yml files.
.github/workflows/scorecard.yml	Pins actions to SHAs and normalizes YAML formatting.
.github/workflows/codeql-analysis.yml	Pins CodeQL-related actions to SHAs and normalizes formatting/indentation.
.github/workflows/ci.yml	Pins CI actions (checkout/pnpm/setup-node/artifacts) to SHAs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.