chore: Fix version pin references (zizmor)

[ditman]

Description

zizmor has started complaining about our version pin comments in our actions.

This PR is the result of running:

$ zizmor --gh-token=$(gh auth token) .github/workflows/ --fix=all

(Sample failure: https://github.com/a2ui-project/a2ui/actions/runs/30672478431?pr=2135)

---

Changing docs.yml in this PR, also uncovered that one of the jobs has overly broad permissions. Restricted to read-only.

Pre-launch Checklist

One time:

• I signed the CLA.
• I read the Contributors Guide.
• I read the Style Guide.
• I have built and run at least one sample.

For this PR:

• I have updated the relevant CHANGELOG.md file.
• I updated/added relevant documentation.
• My code changes (if any) have tests.
• If my branch is on a fork, I have verified that scripts/e2e_test.sh passes.

If you need help, consider asking for advice on the discussion board.

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.

[ditman]

This is the 2nd zizmor fix: setting explicit read-only permissions to the "changes" job.

[ditman]

(Enabling auto-merge)