(MODULES-11831) Harden module_coverage workflow per review

Address Copilot review feedback on PR #179:

- Pin actions/checkout and ruby/setup-ruby to commit SHAs and set
  persist-credentials: false on checkout, matching the hardened pattern
  in module_ci.yml. Also pin upload-artifact and github-script.
- Run the coverage comment step on pull_request_target as well as
  pull_request, so fork PRs that need pull-requests: write still get
  the summary.
- Paginate issues.listComments so the marker comment is found even when
  it drifts past the first page, preventing duplicate coverage comments.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: imaqsood

.github/workflows/module_coverage.yml

@@ -51,12 +51,13 @@ jobs:
     steps:
 
       - name: "Checkout"
-        uses: "actions/checkout@v4"
+        uses: "actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10"  # v6.0.3
         with:
           ref: ${{ github.event.pull_request.head.sha }}
+          persist-credentials: false
 
       - name: "Setup ruby"
-        uses: "ruby/setup-ruby@v1"
+        uses: "ruby/setup-ruby@afeafc3d1ab54a631816aba4c914a0081c12ff2f"  # v1.310.0
         with:
           ruby-version: ${{ inputs.ruby_version }}
           bundler-cache: true
@@ -109,15 +110,15 @@ jobs:
 
       - name: "Upload LCOV report"
         if: ${{ always() }}
-        uses: "actions/upload-artifact@v4"
+        uses: "actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02"  # v4.6.2
         with:
           name: "coverage-lcov"
           path: "coverage/lcov/*.lcov"
           if-no-files-found: "warn"
 
       - name: "Post coverage comment"
-        if: ${{ always() && github.event_name == 'pull_request' }}
-        uses: "actions/github-script@v7"
+        if: ${{ always() && (github.event_name == 'pull_request' || github.event_name == 'pull_request_target') }}
+        uses: "actions/github-script@f28e40c7f34bde8b3046d885e986cb6290c5673b"  # v7.0.1
         with:
           script: |
             const o = ${{ toJSON(steps.gate.outputs) }};
@@ -139,7 +140,7 @@ jobs:
             const body = lines.join('\n');
             const { owner, repo } = context.repo;
             const issue_number = context.issue.number;
-            const { data: comments } = await github.rest.issues.listComments({ owner, repo, issue_number });
+            const comments = await github.paginate(github.rest.issues.listComments, { owner, repo, issue_number, per_page: 100 });
             const prev = comments.find((c) => c.body && c.body.includes('<!-- coverage-gate -->'));
             if (prev) {
               await github.rest.issues.updateComment({ owner, repo, comment_id: prev.id, body });