fix(build.yaml): pin tj-actions/changed-files action due to compromise

[JJGadgets]

Ideally it's be swapped out for an alternative but for now this is to mitigate running known compromised code.

Or, y'all can locally clone the Action's repo from the hash that's been pinned and push it as a mirror to the zmkfirmware org to be more safe for now?

Additionally, automerge and PR creation of updates for this action should be disabled for now to prevent accidental updates to the latest hash.

tj-actions/changed-files#2463
https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised

(Forked, edited and PRed from GitHub Mobile app to make it quick so none of the below have been done, hope y'all don't mind for a simple change)

PR check-list

• Branch has a clean commit history
• Additional tests are included, if changing behaviors/core code that is testable.
• Proper Copyright + License headers added to applicable files (Generally, we stick to "The ZMK Contributors" for copyrights to help avoid churn when files get edited)
• Pre-commit used to check formatting of files, commit messages, etc.
• Includes any necessary documentation changes.