chore: harden GitHub Actions workflows

[jonathan343]

Note

Some actions may be pinned to versions that are not the latest available. This PR intentionally preserves the currently used compatible versions where possible. The scope is to make action references immutable and address the zizmor findings, not to upgrade actions to their latest releases.

Overview

This PR hardens GitHub Actions configuration for aws-sdk-go-v2 to resolve zizmor findings around action pinning, credential persistence, and shell template expansion.

Summary

• Pins GitHub Actions uses: references to full commit SHAs while retaining version comments for readability.
• Uses commit SHAs resolved from the existing action version tags instead of pinning moving tags or branches.
• Sets persist-credentials: false for checkout steps that do not need persisted Git credentials.
• Moves the regression-label check output into an environment variable before using it in the shell run: block.