ci: pin the reviewer to the release carrying credential redaction (#44)

The shared reviewer publishes model findings into pull-request comments, and a
finding can quote the line it is describing. Until this pin moves, that text
reaches a comment without being checked for credential material first.

Both pinned positions move in this one commit. Leaving them out of step would run
one commit's workflow against a different commit's reviewer.

Author: luckyPipewrench

.github/workflows/pr-review.yaml

@@ -35,7 +35,7 @@ jobs:
        github.event_name == 'workflow_dispatch')
     # Pinned to an immutable Pipelock commit in both positions. A branch or tag
     # here would run reviewer code that can change under the pin.
-    uses: luckyPipewrench/pipelock/.github/workflows/pr-review-reusable.yaml@74b3b3f1099d8d6d8ffeb67407ba7e99d1bd3119
+    uses: luckyPipewrench/pipelock/.github/workflows/pr-review-reusable.yaml@aa5c8dc6661c72632533ef6cee9453614ee4d885
     with:
       pr_number: >-
         ${{ github.event_name == 'issue_comment' &&
@@ -45,7 +45,7 @@ jobs:
         (github.event.comment.body == '/review deep' && 'deep' ||
          'default') ||
         inputs.review_mode }}
-      reviewer_sha: 74b3b3f1099d8d6d8ffeb67407ba7e99d1bd3119
+      reviewer_sha: aa5c8dc6661c72632533ef6cee9453614ee4d885
     # Personal-account repositories cannot use secrets: inherit with a reusable
     # workflow, so every secret the reviewer needs is mapped by name.
     secrets: