fix(ci): re-pin panic-attack scan-and-report past the argv-overflow fix (#307)

Security Scan on main is red at the dispatch step (`curl: Argument list
too long`, exit 126, run 28736074871) — the pinned reusable inlined the
whole scan JSON on argv. Fixed upstream in
hyperpolymath/panic-attack#155 (payload via `--data @file` + counts-only
summary fallback above GitHub's ~64KB `repository_dispatch` cap). This
re-pins to that merge commit `906781f`.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

Author: hyperpolymath

.github/workflows/security-scan.yml

@@ -20,6 +20,6 @@ permissions:
 
 jobs:
   scan:
-    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@6a1feb26290ae16f7952fa0ff765a7b061bd50c8 # main 2026-05-20
+    uses: hyperpolymath/panic-attack/.github/workflows/scan-and-report.yml@906781f10c92cc05261cdb99f81dbb47d096a464 # main 2026-07-07 (dispatch payload via file, not argv)
     secrets:
       VERISIMDB_PAT: ${{ secrets.VERISIMDB_PAT }}