Hardening adjustments

[cotti]

Summary

docs-build.yml — Pin elastic/vale-rules/lint to SHA (https://github.com/elastic/docs-eng-team/issues/498)

docs-deploy.yml — Pin elastic/vale-rules/report to SHA (https://github.com/elastic/docs-eng-team/issues/498 / https://github.com/elastic/docs-eng-team/issues/509) + symlink guard (https://github.com/elastic/docs-eng-team/issues/529)

codex-preview.yml — Symlink rejection before deploy (https://github.com/elastic/docs-eng-team/issues/507)

Copilot summary:

This pull request introduces additional safety checks to the documentation build and deployment workflows by rejecting symlinks in build outputs and artifacts, and it also pins GitHub Actions for improved reliability and reproducibility. These changes help prevent potential security or deployment issues caused by symbolic links and ensure consistent action versions are used.

Symlink rejection:

• Added a step to the codex-preview.yml workflow to fail the build if any symlinks are found in the docs build output directory.
• Added a step to the docs-deploy.yml workflow to fail the process if any symlinks are found in the /tmp/link-index-upload artifact before uploading.

Workflow reliability:

• Updated the docs-build.yml workflow to pin the elastic/vale-rules/lint action to a specific commit hash instead of using the main branch.
• Updated the docs-deploy.yml workflow to pin the elastic/vale-rules/report action to a specific commit hash instead of using the main branch.

[Mpdreamz]

We pin all actions except elastic/* and github/* this is per infosec's policies too.

The thinking is we can fix them fast too if something is wrong.

Leaving elastic/vale alone is thus fine.

[Mpdreamz]

@copilot resolve the merge conflicts in this pull request

[Copilot]

We pin all actions except elastic/* and github/* this is per infosec's policies too.

The thinking is we can fix them fast too if something is wrong....

Reverted both elastic/vale-rules/lint and elastic/vale-rules/report back to @main in commit 29ef533.

@copilot resolve the merge conflicts in this pull request

Merge conflicts resolved in commit 29ef533. Accepted origin/main for the auto-generated lock files (.github/aw/actions-lock.json, gh-aw-docs-issue-scope.lock.yml, gh-aw-issue-triage.lock.yml) which had newer versions (v0.69.0), and also reverted the elastic/vale-rules SHA pinning as requested.

[cotti]

@Mpdreamz The merge fixed the pinning, so it's ready for review