ci: pin coverage Python/gcovr and align lockfile docs (#25704)

- Pin coverage job to Python 3.12 and gcovr==8.6
- Record package 3.4.0 in package-lock.json
- Name package-lock.json instead of a missing shrinkwrap in SECURITY.md

Author: enochgroot

.github/workflows/ci.yml

@@ -35,10 +35,9 @@ jobs:
           node-version: 22
       - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
         with:
-          python-version: '3.x'
+          python-version: '3.12'
       - name: Install gcovr
-        run: |
-          gcovr --version || pip install --upgrade gcovr
+        run: pip install gcovr==8.6
       - name: Install dependencies
         run: npm ci
       # Fails the job when JS or native coverage drops below 95%.

SECURITY.md

@@ -76,7 +76,7 @@ that cap throws `msgpack pack limit exceeded` without walking the holes.
 The pins below are inventory, not a calendar SLA:
 
 - msgpack-c **c-7.0.2** (`e17beb371b59459a13b48e166a11e123bda5bf93`)
-- NAN **2.28.0** (compile-in; exact in `package.json` / shrinkwrap)
+- NAN **2.28.0** (compile-in; exact in `package.json` + `package-lock.json`)
 
 Risk-based window: