build: pin actions/github-script to commit SHA in pull_request_target workflow

[XananasX7]

Pin actions/github-script to full commit SHA instead of mutable v8 tag
in the pr_test.yml workflow.

This workflow uses pull_request_target trigger with access to
secrets.TFLM_BOT_REPO_TOKEN. Pinning to SHA ensures immutability
and prevents supply chain attacks via tag manipulation.

Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

[XananasX7]

Summary

This PR pins actions/github-script to a full commit SHA in the pr_test.yml workflow instead of the mutable v8 tag.

Why this matters

The pr_test.yml workflow uses the pull_request_target trigger, which runs in the context of the base repository and has access to secrets.TFLM_BOT_REPO_TOKEN. This makes it a high-value target — a supply chain attack via tag manipulation on actions/github-script could expose that token.

Fix

actions/github-script@v8 → pinned to actions/github-script@f27b608878404679385c85cfa523b85ccb86e213 (the exact commit behind the v8 tag at time of submission), with the version annotated in a comment for human readability.

This is a minimal, low-risk, one-line change. CLA is signed and CI is passing. Ready for review.