ci(release): pin release_ruleset.yaml to full commit SHA (#20)

## What does this PR do?

Pins the bazel-contrib reusable release workflow from the mutable tag
`@v7.7.0` to the immutable commit SHA, matching the SHA-pin convention
already used for every other action in this repo.

```diff
- uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
+ uses: bazel-contrib/.github@1d798ff # v7.7.0
```

This closes a supply-chain gap: a compromised or re-pointed `v7.7.0` tag
can no longer alter the release/attestation (SLSA) pipeline. After this,
**zero** `@vX` tag refs remain across `.github/workflows/`.


## How was it tested?

SHA verified **three independent ways** against `bazel-contrib/.github`,
all resolving to `1d798ff015ed0696433e01e2c3ccbb2abefadad7`:
- `GET /git/refs/tags/v7.7.0`
- `GET /tags` (list)
- `GET /commits/v7.7.0`

…and confirmed that commit contains
`.github/workflows/release_ruleset.yaml` (8820 bytes), ruling out a
wrong-repo/wrong-tree SHA.

- Pin format matches the repo convention (`@<40-hex> # vX.Y.Z`),
consistent with `actions/checkout`, `setup-bazel`, etc.
- pre-commit (check-yaml, prettier, typos, hygiene) — all pass.

## Checklist

- [x] PR title follows [conventional
commit](https://www.conventionalcommits.org/) format
- [x] CI passes (`check.yaml` — lint + test matrix)
- [ ] Tests added or updated for new/changed behavior <!-- N/A:
single-line SHA pin, no behavior change -->
- [x] Documentation updated if user-facing (docstrings, README,
CONTRIBUTING.md) <!-- N/A -->
- [x] No breaking changes (or BREAKING CHANGE section below is filled
out)

Author: clappingmonkey

.github/workflows/release.yaml

@@ -91,7 +91,7 @@ jobs:
   release:
     name: Release
     needs: test
-    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@v7.7.0
+    uses: bazel-contrib/.github/.github/workflows/release_ruleset.yaml@1d798ff015ed0696433e01e2c3ccbb2abefadad7 # v7.7.0
     with:
       release_files: rules_odin-*.tar.gz
       prerelease: false