Freeze a pinned version as the public copy

### Task Summary

Part of #7828. With a version pinned, a workflow has two copies. This routes every read that
serves a viewer without granted access through the frozen one, and freezes the title and the
description with the graph.

- **The seam** — `WorkflowAccessResource.hasGrantedAccess(wid, uid)`: granted access, as
opposed to being able to read a workflow only because it is public. Owner, shared user and
project member keep tracking the author's latest, because sharing is not publishing.
- **`WorkflowPublishService.publicCopyOf`** returns name, description and content as a group,
so no surface can pick up the published graph under a title the author has not published.
- **Title and description freeze with the graph.** They are as public as the graph is: if only
the graph froze, a report about a title could be answered by editing the title while the
pinned copy still advertised it.
- **Routed through it** — opening a workflow, the hub's read of a public workflow, Clone,
Duplicate, `/workflow_name`, `/workflow_description`, and the size a listing shows.

A workflow that follows the author's latest — every workflow today — is served exactly what it
is served now.

Covered by `WorkflowPublishSpec`: the published version reaching a stranger while the author
keeps their own; a collaborator tracking the author's latest as they keep editing; clone and
duplicate taking the published copy including its name and description; a private workflow
still cloning its working copy; the size of each case; and a public copy of a workflow that is
not public being refused rather than falling through.

### Task Type

- [ ] Refactor / Cleanup
- [ ] DevOps / Deployment / CI
- [ ] Testing / QA
- [ ] Documentation
- [ ] Performance
- [x] Other