fix(ci): replace fake action SHA pins (niche-actions estate sweep) (#73)

Estate fake-SHA sweep — niche actions (round-3). Version-faithful where
possible; bumped to nearest in-major where the version comment itself
was hallucinated. All real SHAs verified via `gh api`.

See `project_estate_fake_action_sha_punch_list_2026_05_30` for
substitution map.

Author: hyperpolymath

.github/workflows/security.yml

@@ -47,7 +47,7 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Dependency Review
-        uses: actions/dependency-review-action@3b139cfc5fae8b618d3eae3571e89f4f69d1f5e6 # v4.5.0
+        uses: actions/dependency-review-action@a1d282b36b6f3519aa1f3fc636f609c47dddb294 # v4.5.0
 
   # Build verification
   build: