chore: refine gh workflows for security and consistency

Signed-off-by: tdruez <tdruez@aboutcode.org>

Author: tdruez

.github/workflows/pypi-release.yml

@@ -8,6 +8,7 @@ on:
 
 env:
   PYPI_PROJECT_URL: "https://pypi.org/p/django-altcha"
+  BUILD_VERSION: "1.4.0"
 
 jobs:
   build-python-dist:
@@ -28,7 +29,7 @@ jobs:
           python-version: 3.14
 
       - name: Install pypa/build
-        run: python -m pip install build --user
+        run: python -m pip install "build==${BUILD_VERSION}" --user
 
       - name: Build a binary wheel and a source tarball
         run: python -m build --sdist --wheel --outdir dist/