fix(ci): pin the download-dists action reference to a commit

CodeQL flagged actions/unpinned-tag: @main is mutable, so a compromised
or force-pushed reqstool/.github main would execute through this
reference with no review. Pinned to the commit that added the action,
matching the `@<sha> # main YYYY-MM-DD` convention used elsewhere here.

Went in as @main only because no commit SHA existed to pin to until
reqstool/.github#94 merged.

Signed-off-by: Jimisola Laursen <jimisola@jimisola.com>

Author: jimisola

.github/workflows/release.yml

@@ -109,7 +109,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: reqstool/.github/.github/actions/download-dists@main
+      - uses: reqstool/.github/.github/actions/download-dists@ef815eae0bca7160cdc714126cac73f76d638b39 # main 2026-08-23
         with:
           artifact: dist-tagged
       # Inline, not inside download-dists: nesting this Docker action in a