ci: pin all actions to full SHAs for the org pinning policy

[AvivYossef-starkware]

The org now rejects any workflow action not pinned to a full-length commit SHA (The action X is not allowed in starkware-libs/privacy-bridge because all actions must be pinned to a full-length commit SHA), and both cairo and semgrep are required status checks — so every PR was blocked. This repo's ci.yml was already fully pinned; the only offender was actions/checkout@v4 in .github/workflows/semgrep.yml:40, now pinned to the same SHA already used elsewhere in this repo for actions/checkout@v4 (11d5960a326750d5838078e36cf38b85af677262 # v4). Same fix pattern as starkware-libs/offmarket#1519.

🤖 Generated with Claude Code

---

This change is 

[cursor]

PR Summary

Low Risk
Changes only affect CI runner setup; the manual Foundry install adds a fixed-version download step but does not touch application or contract runtime code.

Overview
Brings GitHub Actions in line with the org rule that every action must be pinned to a full commit SHA, and adjusts the Cairo CI job so required checks can run again.

In semgrep, actions/checkout@v4 is pinned to the same SHA already used in the main CI workflow. In cairo CI, the job now installs the Universal Sierra Compiler via a pinned setup-universal-sierra-compiler action, and Starknet Foundry is installed with a shell step (download v0.62.1 tarball, extract to $RUNNER_TEMP, add bin to PATH) instead of foundry-rs/setup-snfoundry.

^{Reviewed by Cursor Bugbot for commit 9997816. Bugbot is set up for automated code reviews on this repo. Configure here.}