chore: add version branch comments to all SHA-pinned GitHub Actions

[Copilot]

SHA-pinned Actions lacked version comments, making it hard to identify what version is actually in use without cross-referencing commit hashes manually.

Added # vN branch comments to every SHA-pinned uses: line across all workflow files:

• goreleaser.yml: sigstore/cosign-installer (v4), actions/checkout (v4), actions/setup-go (v6), goreleaser/goreleaser-action (v7)
• docker-publish.yml: actions/checkout (v4), docker/setup-qemu-action (v3), docker/setup-buildx-action (v3), docker/metadata-action (v5), docker/login-action (v3), docker/build-push-action (v6)
• codeql-analysis.yml: actions/checkout (v4), actions/setup-go (v6), github/codeql-action/{init,autobuild,analyze} (v4)
• build.yml, test.yml, golangci.yml: actions/checkout (v4), actions/setup-go (v6); golangci.yml also adds golangci/golangci-lint-action (v9)

Before/after example:

# before
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22

# after
uses: sigstore/cosign-installer@ba7bc0a3fef59531c69a25acd34668d6d3fe6f22 # v4

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[Copilot]

Just as a heads up, I was blocked by some firewall rules while working on your feedback. Expand below for details.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• https://api.github.com/repos/actions/checkout/git/refs/tags
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)
• https://api.github.com/repos/actions/checkout/releases
  • Triggering command: /usr/bin/curl curl -s REDACTED (http block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[shino]

@copilot コメントは tag ではなくて branch でおねがい

[Copilot]

@copilot コメントは tag ではなくて branch でおねがい

全てのバージョンコメントをタグ形式（# v6.3.0）からブランチ形式（# v6）に変更しました (72b03b0)