ci: pin containers to digest, enable more zizmor rules (#38779)

Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>

renovate.json5

@@ -100,6 +100,10 @@
       "matchPackageNames": ["mcr.microsoft.com/mssql/server"],
       "allowedVersions": "/^2019($|[.-])/", // pin to oldest in extended support
     },
+    {
+      "matchPackageNames": ["docker.elastic.co/elasticsearch/elasticsearch"],
+      "allowedVersions": "/^8($|[.-])/", // pin to oldest supported major
+    },
     {
       "matchManagers": ["gomod"],
       "postUpdateOptions": ["gomodUpdateImportPaths"],