chore: use SHAs in GitHub Actions and pull_request_target for releases

.github/workflows/release.yml

@@ -8,6 +8,11 @@
         - closed
       branches:
         - main
+    pull_request_target:
+      types:
+        - closed
+      branches:
+        - main
 
   permissions:
     contents: read

.github/workflows/stale.yaml

@@ -1,20 +1,17 @@
----
 name: 'Close stale issues'
 on:
   schedule:
     - cron: '30 1 * * *'
-
 permissions:
   contents: read
-
 jobs:
   stale:
     runs-on: ubuntu-latest
     permissions:
       issues: write
       pull-requests: read
     steps:
-      - uses: actions/stale@v9
+      - uses: actions/stale@28ca1036281a5e5922ead5184a1bbf96e5fc984e # v9
         with:
           stale-issue-message: 'This issue is stale because it has been open 21 days with no activity. Remove stale label or comment or this will be closed in 14 days.'
           close-issue-message: 'This issue was closed because it has been stalled for 35 days with no activity.'