fix(ci): pin Trivy SARIF upload to PR head ref

[DerekRoberts]

Pin the pull request Trivy SARIF upload to the PR head ref and commit SHA to prevent code scanning ruleset stalls on job retries and branch updates.

Under on: pull_request triggers, upload-sarif@v4 defaults to uploading against the temporary test-merge ref (refs/pull/<pr>/merge) and ephemeral merge commit. If downstream repositories require Trivy in their branch protection rulesets (Require code scanning results), any retry, rerun, or merge ref recalculation shifts the merge commit SHA and leaves the PR stuck waiting for Trivy.

This separates the upload step by event type:

• Pull requests explicitly specify ref: refs/pull/<pr>/head and sha: github.event.pull_request.head.sha, binding the scan to the immutable PR head commit.
• Push, schedule, and workflow_dispatch triggers on main retain the default ambient ref and SHA.

Closes #2890

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.