Change `version` default from `latest` to a specific pinned version

## Proposed change
Change the default version input from latest to a pinned stable version (e.g., v0.69.3), aligning with trivy-action's existing approach.

## Background
During the CVE-2026-33634 incident, a malicious v0.69.4 was published and immediately served as latest. All pipelines using the default version automatically fetched and executed the compromised binary — caching is explicitly disabled for latest (inputs.cache == 'true' && inputs.version != 'latest'), so there was no safety net.
trivy-action already mitigates this by defaulting to a pinned version. setup-trivy used standalone does not, making the lower-level action less secure by default than its wrapper.

## Benefits

- Pipelines are not silently exposed to compromised releases
- Caching works by default
- Reduces blast radius of future supply chain incidents

Existing users who explicitly set version: latest would be unaffected.

This is a narrow, straightforward proposal based on what I noticed during the incident. If there's a more comprehensive approach being considered (e.g., checksum verification, signature validation), happy to close this in favor of that.

## References

- CVE-2026-33634 / GHSA-69fq-xp46-6x23
- [trivy-action defaults to a pinned version: action.yaml](https://github.com/aquasecurity/trivy-action/blob/57a97c7e7821a5776cebc9bb87c984fa69cba8f1/action.yaml#L101)

Start with action.yaml, especially the version input and its relationship to the cache condition described in the issue. Change the default to the selected pinned stable version while preserving explicit version: latest behavior, then verify the action metadata and default handling.

Written by the indexing model from the issue text.