CI hardening: SHA-pin bazel-contrib actions in release workflows

The two release-path workflows invoke third-party actions by mutable tag while the rest of the repo (e.g. actions/checkout in update_php_repo.yml) is SHA-pinned. Suggested two-line change for consistency and release supply-chain hygiene — these jobs run with id-token:write and BOT_ACCESS_TOKEN:

--- a/.github/workflows/publish_to_bcr.yaml
+++ b/.github/workflows/publish_to_bcr.yaml
@@ -25 +25 @@
-    uses: bazel-contrib/publish-to-bcr/.github/workflows/[email protected]
+    uses: bazel-contrib/publish-to-bcr/.github/workflows/publish.yaml@748dc7186bc60d0e24a81ee30aba8aa543794767  # v1.0.0



--- a/.github/workflows/release_bazel_module.yaml
+++ b/.github/workflows/release_bazel_module.yaml
@@ -19 +19 @@
-    uses: bazel-contrib/.github/.github/workflows/[email protected]
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@1d798ff015ed0696433e01e2c3ccbb2abefadad7  # v7.7.0

SHAs resolved from the current tags via the GitHub API. Happy to send as a PR if preferred — filing as an issue since workflow changes on privileged release jobs may be something maintainers want to apply directly.