fix: use hash-pinned lock files in CI workflows to resolve PinnedDependencies alerts

Agent-Logs-Url: https://github.com/fabiocaccamo/python-codicefiscale/sessions/2a77746f-8ff6-4f64-bbdd-18cccd8f1ea4

Co-authored-by: fabiocaccamo <1035294+fabiocaccamo@users.noreply.github.com>

Author: Copilot

.github/workflows/create-release.yml

@@ -37,8 +37,7 @@ jobs:
 
       - name: Build Package
         run: |
-          pip install pip --upgrade
-          pip install build
+          pip install --require-hashes -r requirements-build-lock.txt
           python -m build
 
       - name: Publish on PyPI

.github/workflows/test-package.yml

@@ -33,9 +33,9 @@ jobs:
 
     - name: Install dependencies
       run: |
-        python -m pip install --upgrade pip
-        pip install -r requirements.txt
-        pip install -r requirements-test.txt
+        pip install -e . --no-deps
+        pip install --require-hashes -r requirements-lock.txt
+        pip install --require-hashes -r requirements-test-lock.txt
 
     - name: Run pre-commit
       run: |

.github/workflows/update-data.yml

@@ -23,10 +23,10 @@ jobs:
 
       - name: Install dependencies
         run: |
-          python -m pip install --upgrade pip
-          pip install -e .
-          pip install -r requirements-data.txt
-          pip install -r requirements-test.txt
+          pip install -e . --no-deps
+          pip install --require-hashes -r requirements-lock.txt
+          pip install --require-hashes -r requirements-data-lock.txt
+          pip install --require-hashes -r requirements-test-lock.txt
 
       - name: Update data
         run: |