security: address audit findings #4 #5 #6 #7

[JoshLuedeman]

Summary

Addresses all 4 security findings from the prior audit pass.

Changes

• chore: pin base image to versioned tag/digest instead of :latest #4 Pin base image ghcr.io/pops-rox/tf-actions-base to SHA256 digest sha256:b3aa0f0371bc8bb3eb167d33e7946a2121a0cc41f33bc402373d6467eac7a4df (eliminates supply-chain risk from mutable :latest tag)
• security: TERRAFORM_PRE_RUN env var allows arbitrary shell execution with full secret access #5 Document TERRAFORM_PRE_RUN escape hatch in SECURITY.md + inline warning comment in image/actions.sh
• security: printenv in debug function exposes secrets to Actions step debug log #6 Filter sensitive env vars from printenv debug output (TF_VAR_*, ARM_*, AZURE_*, GITHUB_TOKEN, anything containing SECRET/TOKEN/KEY/PASSWORD)
• security: StrictHostKeyChecking disabled globally in container image #7 Remove StrictHostKeyChecking no; replace with hardcoded github.com known_hosts via ssh-keyscan at image build time

Validation

• All grep checks for old patterns return empty (StrictHostKeyChecking gone, mutable :latest replaced)
• New patterns (digest pin, ssh-keyscan, SECURITY: TERRAFORM_PRE_RUN warning, filtered printenv) all present
• Docker build not run locally (Docker daemon unavailable in this environment) — CI will validate

Closes #4, #5, #6, #7