ci: pin conforma actions and reusable workflows to commit SHAs

Pin the cross-org conforma/* references to commit SHAs so all third-party
and cross-org actions are SHA-pinned (EC-2130):
- conforma/pr-size-label-action@v1.0.0 -> 8b1fcdb
- conforma/github-workflows/golang-version-check@main -> db8c967
- conforma/github-workflows/.github/workflows/auto-merge.yaml@main -> db8c967

Co-Authored-By: Claude <noreply@anthropic.com>
Ref: EC-2130

Author: robnester-rh

.github/workflows/auto-merge.yaml

@@ -22,7 +22,7 @@ name: 'Auto merge'
 
 jobs:
   auto-merge:
-    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@main
+    uses: conforma/github-workflows/.github/workflows/auto-merge.yaml@db8c967cda18f9d4c69b1808f703fb61cdf1c650 # main
     secrets: inherit
     permissions:
       pull-requests: write

.github/workflows/checks.yaml

@@ -33,7 +33,7 @@ jobs:
           cache-dependency-path: '**/go.sum'
 
       - name: Check go versions
-        uses: conforma/github-workflows/golang-version-check@main
+        uses: conforma/github-workflows/golang-version-check@db8c967cda18f9d4c69b1808f703fb61cdf1c650 # main
 
       - name: Build all
         run: make all

.github/workflows/label-pr-size.yaml

@@ -29,4 +29,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Label PR by size
-        uses: conforma/pr-size-label-action@v1.0.0
+        uses: conforma/pr-size-label-action@8b1fcdb87ab3ef4b79f9708fedf686904375e2d3 # v1.0.0