[BryanFRD]

Closes #400

• hadolint, cosign, gitleaks, osv-scanner, opengrep: sha256sum -c against a pinned SHA256 before use. Hashes were checked against the upstream checksum files (cosign, gitleaks, osv-scanner, hadolint); opengrep publishes none, so its hash is from the release asset itself.
• trufflehog: pinned v3.99.7 release tarball with checksum instead of install.sh from main.
• opengrep-rules: tarball pinned to a commit SHA instead of refs/heads/main.
• sast-external-issues: new opengrep-sha256 and gitleaks-sha256 inputs next to the version inputs.

Bumping a version now requires updating its hash; a stale hash fails the job. Renovate regex managers for these pins are not included.

[ferrfleet-interne]

I checked all seven pins against upstream: gitleaks 8.21.2, hadolint 2.12.0, cosign 2.4.1, osv-scanner 2.0.2 and trufflehog 3.99.7 match the release checksum files, and opengrep 1.9.0 matches a hash of the downloaded asset. The opengrep-rules commit resolves. Dropping the trufflehog install.sh pipe from main is a real improvement.

Nit: the zizmor alerts on sast-external-issues/action.yml lines 59 and 62 come from the new ${{ inputs.*-sha256 }} expansions inside run:. Pass them through the step's env: (OPENGREP_SHA256: ${{ inputs.opengrep-sha256 }}, same for gitleaks) and use "$OPENGREP_SHA256" in the script. That clears both alerts. The *-version inputs on the same step have the same pattern already and could move to env: in the same change. Low risk either way, since only the calling workflow sets these inputs.

[ferrfleet-interne]

f422d06 fixes my earlier nit: the version and sha256 inputs in sast-external-issues/action.yml now go through env:, and nothing is expanded into the script. I re-hashed the opengrep, gitleaks, hadolint, cosign and trufflehog assets and they still match the pins. Nothing new to flag.