[rubenhensen]

Reverts the SHA pinning from #2. Pinning callers to a commit SHA means a pull request in every repository (~45) for each release of these workflows. With a moving v1 tag a release reaches every caller at once, and change management stays in one place: review here, protected tags.

• zizmor.yml and templates/zizmor.yml: ref-pin for privacybydesign/* again, hash-pin for everything else.
• codeql.yml: filters out actions/unpinned-tag, which flags every @v1 reference (seen in the go-sms-issuer canary). zizmor already requires a SHA for third-party actions. A caller's config-file is merged with the filter with yq, because the action's config input overrides config-file.
• README and CHANGELOG (v1.1.1). Also drops the "not released yet" line.

Before tagging v1.1.1 and v1, go-sms-issuer runs this branch's codeql.yml as a canary.

Part of YIV-401.