ci: pin reusable workflow references to commit SHAs

[pavlovic-ivan]

What

Pins the two external reusable-workflow references to full commit SHAs (tag kept as a trailing comment):

• jenkins-infra/github-reusable-workflows/.github/workflows/maven-cd.yml@v1 → 7704ec4… # v1
• jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2 → da7438f… # v2

Why

GitHub's SHA-pinning policy exempts reusable workflows, but a tag ref is still mutable — a compromised/re-pointed @v1/@v2 in the upstream repo would run here with this repo's GITHUB_TOKEN and the Maven publish secrets it's passed. These are third-party (jenkins-infra) dependencies, so this is the highest-value place to pin. Locking to an immutable SHA is defence-in-depth beyond the exempted policy.

Scope / safety

• Only uses: lines changed (verified: 0 non-uses: edits).
• Trade-off note: @v2 on the security scanner normally floats so its rules stay current. With this pin, Dependabot keeps the SHA (and # v2 comment) updated via reviewed bumps instead of blind auto-tracking — controlled updates rather than freezing. If maintainers prefer the scanner to float, they can revert that single line.

[datadog-armadaproject]

⚠️ Warnings

🚦 1 Pipeline job failed

Jenkins Security Scan | security-scan / scan     

Useful? React with 👍 / 👎

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: d53ca5f | Docs | Datadog PR Page | Give us feedback!}

[pavlovic-ivan]

Heads-up for reviewers: the failing security-scan / scan check is pre-existing and unrelated to this PR.

• This PR only pins jenkins-security-scan.yaml@v2 to da7438f — the exact commit @v2 already resolved to — so the workflow's behaviour is byte-identical before/after the change.
• The failure is inside CodeQL autobuild: mvn clean package … exits 1 ("We were unable to automatically build your code"). That's a build-config issue, not a pinning issue.
• History confirms it: the security-scan has run only twice ever and both runs failed, including the run on main-new in Oct 2025 — well before this branch existed.

The DCO and summary checks pass. Fixing the CodeQL autobuild (e.g. providing explicit build steps instead of relying on autobuild) is a separate follow-up and shouldn't block this SHA-pinning change.

[mergify]

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

• Queue this pull request