Fix: DO-12268 Upgrade dependencies and pin actions to SHAs

[krzysztof-causalens]

Motivation and Context

Resolve the remaining upgrade-only Dependabot alerts selected during triage and harden CI against mutable third-party action tags.

This PR now addresses:

• brace-expansion 1.1.13/2.0.3/5.0.6 → 1.1.16/2.1.2/5.0.7 (3 alerts; see alert 437)
• tmp 0.2.6 → 0.2.7 (1 alert; see alert 362)

It also pins every remote GitHub Action to an immutable commit SHA, preventing a mutable tag from changing the code executed by CI.

Implementation Description

• Added narrow pnpm overrides for the three supported brace-expansion major lines and raised the existing tmp override to 0.2.7.
• Regenerated the pnpm lockfile with only the affected dependency paths changing.
• Replaced all 55 remote uses: references across the test, release, documentation, and PR-lint workflows with full commit SHAs.
• Added each exact release version as an inline comment so automated and manual upgrades remain understandable. Prace is pinned to the exact commit previously referenced by master, documented as package version v1.1.1 plus its post-release security fixes.

No application code or public API changes are included.

Any new dependencies Introduced

None. This upgrades existing transitive dependencies and pins existing CI actions.

How Has This Been Tested?

• actionlint v1.7.12 across all workflows; passes with only the existing publish_docs.yml missing-step-ID diagnostic suppressed
• Verified every remote uses: entry contains a 40-character SHA and a version comment
• pnpm lerna run lint
• pnpm lerna run format:check
• poetry anthology run lint
• pnpm exec lerna run build
• pnpm --filter @darajs/core test — 31 files, 327 tests passed
• cd packages/dara-components && poetry run pytest -q tests/python/plotting/test_bokeh.py — 1 passed
• git diff --check

PR Checklist:

• I have implemented all requirements? (see JIRA, project documentation).
• I am not affecting someone else's work, If I am, they are included as a reviewer.
• I have added relevant tests (unit, integration or regression). Existing dependency compatibility tests and workflow validation cover this change.
• I have added comments to all the bits that are hard to follow. Each pinned action includes its release version.
• I have added/updated Documentation. N/A — no user-facing behavior changed.
• I have updated the appropriate changelog with a line for my changes.

Screenshots (if appropriate):

Not applicable; there are no UI changes.