ci: fix workflows security

[thomasboni]

No description provided.

[cursor]

PR Summary

Low Risk
Low risk: changes are limited to CI/release workflow definitions and an added security policy file, though mis-pins or version constraints could cause CI/release runs to fail.

Overview
Tightens CI/release workflow supply-chain security by pinning third-party uses: steps (e.g., azure/setup-helm, helm/chart-testing-action, helm/chart-releaser-action) to immutable commit SHAs.

Mitigates workflow script-injection by routing the default branch name through env (DEFAULT_BRANCH) before using it in shell commands, and pins helm-unittest (unittest-version: v1.0.3) to remain compatible with Helm 3.10.1.

Adds a new .plumber.yaml enabling GitHub Actions security controls (pin-by-SHA, no dangerous triggers, no debug trace, required actions, etc.) for automated policy analysis.

^{Reviewed by Cursor Bugbot for commit 355fbc8. Bugbot is set up for automated code reviews on this repo. Configure here.}