chore: update GitHub Actions workflows to pin action versions and improve formatting

[jongalloway]

No description provided.

[Copilot]

Pull request overview

This PR updates multiple GitHub Actions workflows to improve supply-chain security and consistency by pinning third-party actions to immutable commit SHAs and standardizing YAML formatting.

Changes:

• Pinned commonly used GitHub Actions (e.g., actions/checkout, actions/setup-dotnet, artifacts, Codecov, NuGet login, CodeQL) to specific commit SHAs.
• Normalized YAML indentation/formatting across workflows (including list formatting and workflow_dispatch structure).
• Minor readability tweaks (e.g., moving inline comments to their own lines in on.workflow_dispatch).

Show a summary per file

File	Description
.github/workflows/release-scenarios.yml	Reformats workflow and pins checkout/setup-dotnet to commit SHAs for the manual release scenario test runs.
.github/workflows/publish-nuget.yml	Pins publishing pipeline actions (checkout/setup-dotnet/NuGet login/artifacts) to commit SHAs and improves workflow_dispatch formatting.
.github/workflows/publish-mcp-registry.yml	Pins actions/checkout to a commit SHA for registry publishing workflow consistency.
.github/workflows/copilot-setup-steps.yml	Pins checkout and setup-dotnet to commit SHAs for reproducible Copilot setup steps.
.github/workflows/codeql.yml	Pins checkout, setup-dotnet, and CodeQL actions; also normalizes trigger formatting.
.github/workflows/build.yml	Pins actions used across build/test/coverage jobs and standardizes trigger list formatting.

Copilot's findings

• Files reviewed: 6/6 changed files
• Comments generated: 0