security(workflows): pin Helm install and verify checksum in prometheus and goldpinger update workflows

[xavpaice]

Addresses the security review comment on the Rook update workflow PR (#6116) by applying the same fix to the Prometheus and Goldpinger update workflows.

Problem

Both workflows were installing Helm by piping the upstream get-helm-3 script directly to bash:

curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash

This executes a mutable, unverified third-party script in a job that later uses the repository automation PAT (secrets.AUTOMATED_PR_GH_PAT).

Fix

Replace the pipe-to-bash install with a pinned Helm binary download and a hardcoded SHA-256 checksum verification:

- name: Install Helm
  env:
    HELM_VERSION: 4.2.4
    HELM_SHA256: c306b46f719b0a4da32d0f78ee21bf90ce8d602f15b22ab753f0674d1670a7f3
  run: |
    curl -fsSL "https://get.helm.sh/helm-v${HELM_VERSION}-linux-amd64.tar.gz" -o helm.tar.gz
    echo "${HELM_SHA256}  helm.tar.gz" | sha256sum -c
    tar -xzf helm.tar.gz
    sudo mv linux-amd64/helm /usr/local/bin/helm
    rm -rf helm.tar.gz linux-amd64

This pins the installer source and verifies the archive integrity before executing any Helm binary.

[greptile-apps]

_{Reviews (1): Last reviewed commit: "security(workflows): pin Helm install an..." | Re-trigger Greptile}

[greptile-apps]

_{Reviews (2): Last reviewed commit: "fixup! security(workflows): pin Helm 3.2..." | Re-trigger Greptile}

[kriscoleman]