iOS workflows pass every secret to a third-party action on a mutable tag

Several iOS workflows pass every repository secret to a third-party reusable
workflow pinned to a mutable tag.

ios-collect-prs-summary.yml:19    secrets: inherit
ios-nightly-distribution.yml:99   novasamatech/github-actions/...@v5
ios-release-distribution.yml:57   @v5
ios-build-distribute.yml:170,339  @v5

secrets: inherit hands the callee every secret this repository holds, which now
includes ASC_KEY_BASE64, MATCH_PASSWORD and the Firebase service account. The
callee is selected at run time from a tag someone outside this project can move.

This is pre-existing and predates the re-homing, but it is worth recording
because it is the one remaining way a workflow that is not held could be made to
reach Apple: the guard is on our side, the code it runs is not.

Steps

• Pin the third-party actions to a commit SHA, as the rest of ci.yml does
• Replace secrets: inherit with an explicit list of what each callee needs
• Decide whether these actions should be vendored or replaced, given the
  ownership question already open on them

Found during the pre-merge review of #787. Belongs on the cutover radar rather
than in that change.

Start with ios-collect-prs-summary.yml, ios-nightly-distribution.yml, ios-release-distribution.yml, and ios-build-distribute.yml, then compare their workflow references with the SHA-pinned actions in ci.yml. Identify the secrets each reusable workflow needs and review the ownership question already open on these actions. Done means the workflows use immutable references, pass only required secrets, and have a documented decision on vendoring or replacement.