(chore) pin dependencies for workflows and Docker base images

[smoy]

Addressing two of the three issues from ossf/scorecard

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:45
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/ci.yml:71

Warn: containerImage not pinned by hash: Dockerfile:1
Warn: containerImage not pinned by hash: Dockerfile:9: pin your Docker image by updating python:3.12-slim-bookworm to python:3.12-slim-bookworm@sha256:8a7e7cc04fd3e2bd787f7f24e22d5d119aa590d429b50c95dfe12b3abe52f48b
Warn: pipCommand not pinned by hash: Dockerfile:7

[rng1995]

[Automated SkillSpector Review]

Approved. Both checkout uses are pinned to the immutable v4.2.2 commit, and both Docker stages pin the same immutable Python image digest. The diff is limited to supply-chain pinning and introduces no runtime/schema change. Current Python jobs fail formatting only in unchanged mcp_least_privilege.py, a known mainline drift outside this PR; DCO passes.

[rng1995]

Fix linting issues @smoy

[smoy]

Fix linting issues @smoy

rebsed from upstream.

make line is clean now

 make lint              
Running ruff...
ruff check src/ tests/
All checks passed!