CI: require the AI usage disclosure and finish the shell-injection hardening (#1054)

PR template: port the "No AI assistance" option and the "tick exactly one" note
from all-the-plugins (xMasterX/all-the-plugins#249) so the two repos agree, and
add a check that fails the PR unless exactly one of the three boxes is ticked.
The check needs no token and checks out nothing (`permissions: {}`), so plain
`pull_request` is safe for forks; `edited` is in the trigger list so fixing the
description re-runs it.

pr-build.yml: #1052 bound github.head_ref/ref_name to env, but the branch name
still reached a `run:` block through steps.vars.outputs.ref/.dist, which the
"Assemble PR report" step interpolated. A branch named `x$(id)` still executed
there. Bind those outputs to env as well, and reduce SAFE_REF to
[A-Za-z0-9._-] instead of only replacing '/', so the outputs are inert for
every consumer. Artifact names are unchanged for ordinary branch names.

Pin the two third-party actions to commits: dessant/lock-threads runs with
issues+pull-requests write, and a mutable tag can be repointed at any time.

.github/workflows/codeql.yml

@@ -91,7 +91,8 @@ jobs:
           upload: "failure-only" # disable the upload here - we will upload in a different action
 
       - name: Filter dirs for SARIF
-        uses: advanced-security/filter-sarif@v1
+        # Third-party action pinned to a commit; mutable tags can be repointed.
+        uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1
         if: ${{ success() }}
         with:
           # filter out all test files unless they contain a sql-injection vulnerability