Backport workflow-hardening fix (unpinned-uses) to 5 release branches

### Summary
The default branch already hardened `.github/workflows/main.yml` against the issue(s) below, but **5** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor))
- `unpinned-uses` — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:
- https://github.com/metamask/core/commit/6c35b385acdee5bbf80bb38c09dd480934e220ea

### Affected release branches (5)
- **`release/864.0.0-1`** (still present as of HEAD `8190e4d3`)
- **`release/753.0.0`** (still present as of HEAD `d5220d9f`)
- **`release/843.0.0`** (still present as of HEAD `d42b2df8`)
- **`release/1058.0.0`** (still present as of HEAD `11fadce9`)
- **`release/939.0.0`** (still present as of HEAD `4d77bfb4`)

### Suggested per-branch patches
Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/864.0.0-1 — unpinned-uses

File `.github/workflows/main.yml`; suggested edits:
- ~ jobs.$J.steps[id=is-release].uses : pin(MetaMask/action-is-release -> target_ref SHA)

```diff
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -100,7 +100,7 @@
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
steps:
- id: is-release
- uses: MetaMask/action-is-release@v2
+ uses: MetaMask/action-is-release@61ff8882da996cb68cdbc8583dc53956a1ffdd8b # v2
with:
commit-starts-with: 'Release [version],Release v[version],Release/[version],Release/v[version],Release `[version]`'
```

release/753.0.0 — unpinned-uses

File `.github/workflows/main.yml`; suggested edits:
- ~ jobs.$J.steps[id=is-release].uses : pin(MetaMask/action-is-release -> target_ref SHA)

```diff
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -100,7 +100,7 @@
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
steps:
- id: is-release
- uses: MetaMask/action-is-release@v2
+ uses: MetaMask/action-is-release@61ff8882da996cb68cdbc8583dc53956a1ffdd8b # v2
with:
commit-starts-with: 'Release [version],Release v[version],Release/[version],Release/v[version],Release `[version]`'
```

release/843.0.0 — unpinned-uses

File `.github/workflows/main.yml`; suggested edits:
- ~ jobs.$J.steps[id=is-release].uses : pin(MetaMask/action-is-release -> target_ref SHA)

```diff
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -100,7 +100,7 @@
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
steps:
- id: is-release
- uses: MetaMask/action-is-release@v2
+ uses: MetaMask/action-is-release@61ff8882da996cb68cdbc8583dc53956a1ffdd8b # v2
with:
commit-starts-with: 'Release [version],Release v[version],Release/[version],Release/v[version],Release `[version]`'
```

release/1058.0.0 — unpinned-uses

File `.github/workflows/main.yml`; suggested edits:
- ~ jobs.$J.steps[id=is-release].uses : pin(MetaMask/action-is-release -> target_ref SHA)

```diff
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -104,7 +104,7 @@
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
steps:
- id: is-release
- uses: MetaMask/action-is-release@v2
+ uses: MetaMask/action-is-release@61ff8882da996cb68cdbc8583dc53956a1ffdd8b # v2
with:
commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }}
```

release/939.0.0 — unpinned-uses

File `.github/workflows/main.yml`; suggested edits:
- ~ jobs.$J.steps[id=is-release].uses : pin(MetaMask/action-is-release -> target_ref SHA)

```diff
--- a/.github/workflows/main.yml
+++ b/.github/workflows/main.yml
@@ -102,7 +102,7 @@
IS_RELEASE: ${{ steps.is-release.outputs.IS_RELEASE }}
steps:
- id: is-release
- uses: MetaMask/action-is-release@v2
+ uses: MetaMask/action-is-release@61ff8882da996cb68cdbc8583dc53956a1ffdd8b # v2
with:
commit-starts-with: ${{ vars.RELEASE_COMMIT_PREFIX }}
```

---
*Happy to open pull requests instead if that's preferred.*

Update .github/workflows/main.yml on each of the five named release branches, starting with the is-release step and the suggested action SHA. Run zizmor and actionlint for each branch to confirm the unpinned-uses findings are cleared without new findings. Done means all five branches use the pinned action and pass both checks.

Written by the indexing model from the issue text.