[Sync] Update project files from source repository (3a1151a)

[mrz1836]

What Changed

• Added input sanitization in .github/actions/setup-benchstat/action.yml to strip CR/LF characters from BENCHSTAT_VERSION, BENCHSTAT_VERSION_LATEST, BENCHSTAT_LATEST_MIN_GO, and GO_VERSION variables to prevent output-injection attacks
• Added validation checks in .github/actions/setup-benchstat/action.yml to reject Go versions with MAJOR < 1 (both for minimum Go version and runtime Go version) to prevent malformed input
• Implemented summary_is_corrupt function checks in .github/actions/validate-test-results/action.yml to detect and handle unparseable JSON summaries in three locations (validation loop, aggregation loop, and summary generation)
• Updated GO_PRE_COMMIT_VERSION from v1.10.0 to v1.10.1 in .github/env/10-pre-commit.env
• Updated MAGE_X_GORELEASER_VERSION from v2.17.1 to v2.18.0 in .github/env/10-mage-x.env
• Enhanced .github/scripts/test-result-helpers.sh with additional safety guards: added summary_is_corrupt function, added return 0 statements to helpers, and added default empty-string fallbacks in variable assignments
• Modified permissions and content in .github/workflows/fortress-security-scans.yml, .github/workflows/codeql-analysis.yml, .github/workflows/fortress-test-matrix.yml, and .github/workflows/scorecard.yml

Why It Was Necessary

• Prevent security vulnerabilities from output-injection attacks where crafted input containing newlines could inject workflow commands or append key=value pairs to $GITHUB_OUTPUT
• Improve resilience against corrupted or truncated JSONL test result files that would otherwise silently coerce to zero failures and cause tests to incorrectly pass
• Update tooling versions to latest releases for bug fixes and improvements

Testing Performed

• Input sanitization logic tested against strings containing CR/LF characters to verify stripping behavior
• Version validation tested with edge cases including 0.x versions to confirm rejection of invalid Go versions
• JSON corruption detection tested with malformed summary lines to verify hard-failure behavior instead of silent coercion to zero

Impact / Risk

• Security Impact: Hardens GitHub Actions against injection attacks by sanitizing user-controlled inputs before they reach command sinks or output files
• Test Reliability: Prevents false-positive test passes by detecting corrupted JSONL files and treating them as failures instead of letting fields silently coerce to zero
• Breaking Change: None - changes add validation and error handling without modifying successful-path behavior
• Risk Level: Low - defensive improvements that make failures explicit rather than changing success criteria

[mrz1836]

LGTM!