Enhance security across workflows

[yaswant]

• Pinning GitHub Actions to a specific git commit hash (SHA) rather than a mutable version tag (like v1) is the industry standard for securing public-facing repositories.
• Don't interpolate context expressions in Shell scripts; instead, map the expression to an environment variable in the env: block first, then reference it using native shell syntax ($VAR or "$VAR")

Review workflows:

• check-cr-approved.yaml
• checks.yaml
• ci.yaml
• cla-check.yaml
• docs.yaml Secure docs workflow #26
• track-review-project.yaml
• trigger-project-workflow.yaml