Pin all third-party actions to full-length commit SHAs to prevent supply-chain attacks via tag repointing. Replace trivy-action@master with pinned 0.34.0 release. Resolves code scanning alerts for actions/unpinned-tag.