Update nightly schedule to Tue/Thu at 9:30 PM PT and fix security issues

[brandonpage]

Summary

Implements W-22712082 — Cleanup CI for all Repos.

Schedule change: Nightly tests now run Tue/Thu at 9:30 PM PT (30 5 * * 3,5 UTC), up from Wed-only. Catches regressions twice a week instead of once. Alternates with the ReactNative nightly's Mon/Wed/Fri 9:30 PM slot.

Security hardening: All workflows updated to follow the GitHub Actions injection-prevention best practices:

• All third-party actions SHA-pinned with the resolved tag in a comment.
• Top-level permissions: block added to every workflow: contents: read baseline, pull-requests: write for the test reusable (it uses mikepenz/action-junit-report with comment: true).
• secrets: inherit replaced with explicit secret pass-through; reusable test workflow declares TEST_CREDENTIALS and CODECOV_TOKEN in on: workflow_call: secrets:.
• All ${{ ... }} shell interpolation in run: blocks refactored to env: variables with quoted shell expansions (only the Parse test results step in the reusable test workflow had any).
• pull_request_target retained with # zizmor: ignore[dangerous-triggers] and inline comment documenting the Member Check mitigation.
• actions/checkout steps set with: persist-credentials: false.
• xcodebuild logs archived on build failure for diagnostic purposes.

After this change, zizmor --offline reports 0 High-confidence findings across all four CI workflows.

Test plan

• Verified locally with python3 yaml.safe_load, actionlint -shellcheck=, zizmor --offline. All clean.
• CI verification: opened test PR on personal fork (brandonpage/SalesforceMobileSDK-iOS-Hybrid#2) targeting the same cleanup-ci-w22712082 branch as this PR. The test PR triggers the new workflows against a real source change in SalesforceFileLogger. No regressions observed — see linked PR for run details.
• Reviewer to confirm the permissions: blocks match the team's expected privilege levels for each workflow.

🤖 Generated with Claude Code

[github-actions]

	Tests	Passed ✅	Skipped	Failed
SalesforceFileLogger iOS ^26 Test Results	15 ran	15 ✅

Test	Result
No test annotations available

• View SalesforceFileLogger iOS ^26 Test Results

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.62%. Comparing base (32f0f24) to head (99687ef).
⚠️ Report is 4 commits behind head on dev.

Additional details and impacted files

@@           Coverage Diff           @@
##              dev     #306   +/-   ##
=======================================
  Coverage   62.62%   62.62%           
=======================================
  Files          21       21           
  Lines        1699     1699           
=======================================
  Hits         1064     1064           
  Misses        635      635           

Flag	Coverage Δ
SalesforceFileLogger	70.55% <ø> (ø)
SalesforceHybridSDK	60.74% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

	Tests	Passed ✅	Skipped	Failed
SalesforceHybridSDK iOS ^26 Test Results	150 ran	150 ✅

Test	Result
No test annotations available

• View SalesforceHybridSDK iOS ^26 Test Results