security: pin actions/github-script to commit SHA (SECCMP-1797)

actions/github-script@v7 was a mutable tag — a supply chain compromise of
the upstream action could silently alter behavior. Pin to commit SHA for
reproducible, tamper-evident builds.

SHA: f28e40c7f34bde8b3046d885e986cb6290c5673b (v7)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: SameeraPriyathamTadikonda

.github/workflows/copyright-check.yml

@@ -95,7 +95,7 @@ jobs:
     - name: Post / Update PR comment with summary
       id: pr-comment
       if: always() && steps.changed-files.outputs.skip-validation != 'true'
-      uses: actions/github-script@v7
+      uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
       env:
         VALIDATION_STATUS: ${{ steps.validate.outputs.status }}
       with: