TruffleHog action is pinned but the scanner image it runs is not (version: latest)

[hyperpolymath]

The TruffleHog action is pinned (trufflesecurity/trufflehog@v3.97.5) but the
scanner it runs is not. The action's version input defaults to latest,
and its final command is:

docker run --rm -v .:/tmp -w /tmp "${IMAGE}:${VERSION}" git file:///tmp/ ...

So the container tag resolves to latest at run time.

Measured

On PR #846 the job log reports:

"trufflehog_version": "3.97.6"

while the workflow pins the action at v3.97.5. The pin describes the wrapper,
not the detector.

Why this matters here

Detector behaviour is what this gate's verdict is made of. An unpinned scanner
can change its detector set, its verification logic or its exit semantics
between two runs of an unchanged workflow — so a green can become a red, or a
red a green, with nothing in the repository having changed and nothing in the
log saying why. That is the same class of problem as #844: the check's result
stops being traceable to a stated cause.

It is also a supply-chain surface. A SHA-pinned action that then pulls a
floating image tag gives the appearance of pinning without the property.

Acceptance criteria

1. version: is set explicitly on both TruffleHog steps, matching the pinned
   action version, so the scanner is reproducible.
2. Preferably the image is referenced by digest rather than tag.
3. The job log prints the scanner version it actually ran, so a drift is
   visible in the run rather than only in the workflow file.
4. A note in the workflow explaining that the action pin and the scanner pin
   are two separate things, so a future bump moves both.
5. Bumping the pin is a deliberate, reviewable change — confirmed by a run
   whose log shows the new version.

Found while fixing #844.