ci: pin reusable workflow ref to commit SHA for security

Replace mutable @main ref with pinned SHA 239d0b4 to prevent
secret exposure via supply chain attack on pull_request_target trigger.

Ref: Mininglamp-OSS/.github#12

Author: lml2468

.github/workflows/auto-add-to-project.yml

@@ -11,6 +11,6 @@ permissions: {}
 
 jobs:
   add-to-project:
-    uses: Mininglamp-OSS/.github/.github/workflows/auto-add-to-project.yml@main
+    uses: Mininglamp-OSS/.github/.github/workflows/auto-add-to-project.yml@239d0b47cfe1947d5e6de826e795feac4ed90562
     secrets:
       PROJECT_TOKEN: ${{ secrets.PROJECT_TOKEN }}