Backport workflow-hardening fix (unpinned-uses) to 5 release branches

### Summary
The default branch already hardened `.github/workflows/build.yml` against the issue(s) below, but **5** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor))
- `unpinned-uses` — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:
- https://github.com/hashicorp/consul-template/commit/a7f92596cb25f625ffb3d4e2eb415b9009614d0b

### Affected release branches (5)
- **`release/0.40.0`** (still present as of HEAD `781ce198`)
- **`release/0.39.1`** (still present as of HEAD `cc8f9545`)
- **`release/0.38.1`** (still present as of HEAD `199f4a30`)
- **`release/0.38.0`** (still present as of HEAD `507ac655`)
- **`release/0.39.0`** (still present as of HEAD `9e7e00e3`)

### Suggested per-branch patches
Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

release/0.40.0 — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=hashicorp/actions-docker-build].uses : pin(hashicorp/actions-docker-build -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J3.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J4.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -210,7 +210,7 @@
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Docker Build (Action)
- uses: hashicorp/actions-docker-build@v2
+ uses: hashicorp/actions-docker-build@e12557abf02a40557313ab2839d6cd2c6705261e # v2
with:
# Add smoke test here. Below is a sample smoke test that runs the built image
# and validates the version.
```

release/0.39.1 — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=hashicorp/actions-docker-build].uses : pin(hashicorp/actions-docker-build -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J3.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J4.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -210,7 +210,7 @@
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Docker Build (Action)
- uses: hashicorp/actions-docker-build@v2
+ uses: hashicorp/actions-docker-build@e12557abf02a40557313ab2839d6cd2c6705261e # v2
with:
# Add smoke test here. Below is a sample smoke test that runs the built image
# and validates the version.
```

release/0.38.1 — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=hashicorp/actions-docker-build].uses : pin(hashicorp/actions-docker-build -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J3.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J4.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -241,7 +241,7 @@
steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- name: Docker Build (Action)
- uses: hashicorp/actions-docker-build@v2
+ uses: hashicorp/actions-docker-build@e12557abf02a40557313ab2839d6cd2c6705261e # v2
with:
# Add smoke test here. Below is a sample smoke test that runs the built image
# and validates the version.
```

release/0.38.0 — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=hashicorp/actions-docker-build].uses : pin(hashicorp/actions-docker-build -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J3.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J4.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -241,7 +241,7 @@
steps:
- uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
- name: Docker Build (Action)
- uses: hashicorp/actions-docker-build@v2
+ uses: hashicorp/actions-docker-build@e12557abf02a40557313ab2839d6cd2c6705261e # v2
with:
# Add smoke test here. Below is a sample smoke test that runs the built image
# and validates the version.
```

release/0.39.0 — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=hashicorp/actions-docker-build].uses : pin(hashicorp/actions-docker-build -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J2.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J3.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)
- ~ jobs.$J4.steps[uses=actions/upload-artifact].uses : pin(actions/upload-artifact -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -241,7 +241,7 @@
steps:
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
- name: Docker Build (Action)
- uses: hashicorp/actions-docker-build@v2
+ uses: hashicorp/actions-docker-build@e12557abf02a40557313ab2839d6cd2c6705261e # v2
with:
# Add smoke test here. Below is a sample smoke test that runs the built image
# and validates the version.
```

---
*Happy to open pull requests instead if that's preferred.*

Work in .github/workflows/build.yml on each of the five listed release branches, comparing the branch-specific workflow with the provided suggested edits. Apply the pinned action references, then run zizmor and actionlint for every branch; done means the unpinned-uses findings are cleared without new findings.

Written by the indexing model from the issue text.