ci: tidb_build composite uses bazel-contrib/setup-bazel@0.16.0 (mutable tag) while forwarding GCP_SA_KEY — check-bazel-prepare.yml already SHA-pins the same version

## Enhancement

Hi, and thank you for TiDB.

While reading the Bazel CI setup I noticed the repository pins `bazel-contrib/setup-bazel` two
different ways, and the credential-forwarding path is the unpinned one.

**The composite action uses a mutable tag and forwards the GCP key:**

`.github/actions/tidb_build/action.yml`

```yaml
18: uses: bazel-contrib/setup-bazel@0.16.0
...
24: google-credentials: ${{ inputs.gcp_sa_key }}
```

**The same action, same version, is already SHA-pinned elsewhere:**

`.github/workflows/check-bazel-prepare.yml`

```yaml
31: uses: bazel-contrib/setup-bazel@8310a45e30297e76bc8fbae427fb6068efa01eb8 # 0.16.0
```

And the real secret reaches that composite from `.github/workflows/bazel-build-crossbuild.yml`:

```yaml
31: gcp_sa_key: ${{ secrets.GCP_SA_KEY }}
```

### Why it seemed worth raising

A git tag is mutable — it can be repointed to a different commit without anything changing in this
repository. So the code that receives `GCP_SA_KEY` is whatever `0.16.0` resolves to at run time,
rather than a reviewed commit. This is the `tj-actions/changed-files` class of risk, and it is also
what GitHub's own
[hardening guidance](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
recommends pinning against.

I want to be careful not to overstate this: `bazel-contrib/setup-bazel` is a well-run action and I
have no reason to think anything is wrong with it today. This is defence-in-depth, and mostly a
**consistency** point — the repository has already made this exact decision in
`check-bazel-prepare.yml`; the composite action just did not get the same treatment.

### Suggested change

Pin line 18 to the same commit `check-bazel-prepare.yml` already uses, keeping the version readable
in a trailing comment, so both places agree:

```yaml
uses: bazel-contrib/setup-bazel@8310a45e30297e76bc8fbae427fb6068efa01eb8 # 0.16.0
```

Same version, so behaviour is unchanged, and Dependabot can bump the SHA the same way it bumps the tag.

I have opened #69865 with this one-line change. Happy to close both if you would rather keep the tag
here deliberately — that is entirely your call and I would not want to churn your CI over a preference.

_{For transparency: I used AI assistance to help spot this and draft the write-up. I verified all
four file references above against the current source myself and take responsibility for them.}

Compare .github/actions/tidb_build/action.yml with .github/workflows/check-bazel-prepare.yml, then check the call from .github/workflows/bazel-build-crossbuild.yml. Confirm that both setup-bazel references use the same reviewed commit while retaining the readable version comment; issue #69865 already contains the proposed one-line change.

Written by the indexing model from the issue text.