ci: bump pipelock SHA pin to v2.4.0 (#11)

Pipelock v2.4.0 tagged 2026-05-09. Bump the SHA-pinned action ref so the
verify-python CI smoke runs against the current shipped pipelock.

SHA 9b38f69593b24964042dfeb1f13d7088832bf817 corresponds to git tag v2.4.0
in luckyPipewrench/pipelock.

Verifier behaviour unchanged.

Author: luckyPipewrench

.github/workflows/ci.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Pipelock Scan
-        uses: luckyPipewrench/pipelock@7a3b7de4a5552b4e756eb930256468b7cbd616b1 # v2.3.0
+        uses: luckyPipewrench/pipelock@9b38f69593b24964042dfeb1f13d7088832bf817 # v2.4.0
         with:
           scan-diff: 'true'
           fail-on-findings: 'true'