Fix remaining AGPL SPDX in Rust files and SHA-pin nested workflow actions

- AGPL-3.0-or-later → PMPL-1.0-or-later in .rs source files
- SHA-pin remaining checkout@v2/v3, upload-artifact@v3, cache@v3,
  setup-node@v3 in nested/submodule workflow files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

plugin-conflict-mapper/.github/workflows/php.yml

@@ -23,7 +23,7 @@ jobs:
 
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v3
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}

sinople-theme/.github/workflows/symfony.yml

@@ -30,7 +30,7 @@ jobs:
       run: php -r "file_exists('.env.test.local') || copy('.env.test', '.env.test.local');"
     - name: Cache Composer packages
       id: composer-cache
-      uses: actions/cache@v3
+      uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4
       with:
         path: vendor
         key: ${{ runner.os }}-php-${{ hashFiles('**/composer.lock') }}