Backport workflow-hardening fix (unpinned-uses) to 4 release branches

### Summary
The default branch already hardened `.github/workflows/blocked.yaml`, `.github/workflows/changelog-label.yml` against the issue(s) below, but **4** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor))
- `unpinned-uses` — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:
- https://github.com/element-hq/element-call/commit/cc8ab0ac933e666512c9fef9bdec27ef7c620f46
- https://github.com/element-hq/element-call/commit/cf0cb2ebd28adfe80e78de7bd74d2b1df37607e5

### Affected release branches (4)
- **`release-v0.9.0`** (still present as of HEAD `4644fc89`)
- **`release-v0.11.1`** (still present as of HEAD `b5f526f9`)
- **`release-v0.11.0`** (still present as of HEAD `6e9b837f`)
- **`release-v0.8.0`** (still present as of HEAD `a2df8fae`)

### Suggested per-branch patches
Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release-v0.9.0 — unpinned-uses

File `.github/workflows/blocked.yaml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/github-script].uses : pin(actions/github-script -> target_ref SHA)

```diff
--- a/.github/workflows/blocked.yaml
+++ b/.github/workflows/blocked.yaml
@@ -10,7 +10,7 @@
pull-requests: read
steps:
- name: Add notice
- uses: actions/github-script@v7
+ uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
if: contains(github.event.pull_request.labels.*.name, 'X-Blocked')
with:
script: |
```

release-v0.11.1 — unpinned-uses

File `.github/workflows/changelog-label.yml`; suggested edits:
- ~ jobs.$J.steps[uses=yogevbd/enforce-label-action].uses : pin(yogevbd/enforce-label-action -> target_ref SHA)

```diff
--- a/.github/workflows/changelog-label.yml
+++ b/.github/workflows/changelog-label.yml
@@ -7,7 +7,7 @@
pr-changelog-label:
runs-on: ubuntu-latest
steps:
- - uses: yogevbd/enforce-label-action@2.1.0
+ - uses: yogevbd/enforce-label-action@8d1e1709b1011e6d90400a0e6cf7c0b77aa5efeb # 2.1.0
with:
REQUIRED_LABELS_ANY: "PR-Bug-Fix,PR-Documentation,PR-Task,PR-Feature,PR-Improvement,PR-Developer-Experience,dependencies"
REQUIRED_LABELS_ANY_DESCRIPTION: "Select at least one 'PR-' label"
```

release-v0.11.0 — unpinned-uses

File `.github/workflows/changelog-label.yml`; suggested edits:
- ~ jobs.$J.steps[uses=yogevbd/enforce-label-action].uses : pin(yogevbd/enforce-label-action -> target_ref SHA)

```diff
--- a/.github/workflows/changelog-label.yml
+++ b/.github/workflows/changelog-label.yml
@@ -7,7 +7,7 @@
pr-changelog-label:
runs-on: ubuntu-latest
steps:
- - uses: yogevbd/enforce-label-action@2.1.0
+ - uses: yogevbd/enforce-label-action@8d1e1709b1011e6d90400a0e6cf7c0b77aa5efeb # 2.1.0
with:
REQUIRED_LABELS_ANY: "PR-Bug-Fix,PR-Documentation,PR-Task,PR-Feature,PR-Improvement,PR-Developer-Experience,dependencies"
REQUIRED_LABELS_ANY_DESCRIPTION: "Select at least one 'PR-' label"
```

release-v0.8.0 — unpinned-uses

File `.github/workflows/blocked.yaml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/github-script].uses : pin(actions/github-script -> target_ref SHA)

```diff
--- a/.github/workflows/blocked.yaml
+++ b/.github/workflows/blocked.yaml
@@ -10,7 +10,7 @@
pull-requests: read
steps:
- name: Add notice
- uses: actions/github-script@v7
+ uses: actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b # v7
if: contains(github.event.pull_request.labels.*.name, 'X-Blocked')
with:
script: |
```

---
*Happy to open pull requests instead if that's preferred.*

Review .github/workflows/blocked.yaml and .github/workflows/changelog-label.yml on the four named release branches, comparing them with the default-branch hardening commits. Apply the corresponding action pins, then run zizmor and actionlint for each branch; done means all four affected findings are cleared without new findings.

Written by the indexing model from the issue text.