build: pin peter-evans/repository-dispatch to commit SHA

[XananasX7]

Pin peter-evans/repository-dispatch to full commit SHA instead of mutable
v4 tag. This workflow has access to secrets.BAZEL_DOC_TRIGGER_TOKEN
(a fine-grained PAT with write access to bazel-contrib/bazel-docs).

Pinning to SHA ensures immutability and prevents supply chain attacks
via tag manipulation of the third-party action.

Ref: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

[XananasX7]

Summary

This PR pins peter-evans/repository-dispatch to a full commit SHA instead of a mutable version tag.

Why this matters

The workflow using this action runs on push and pull_request events. The peter-evans/repository-dispatch action is used to trigger downstream CI workflows. A supply chain attack via tag manipulation on this action could be used to trigger arbitrary repository dispatch events or interfere with CI pipelines.

Fix

peter-evans/repository-dispatch@v3 → pinned to its exact commit SHA, with the version annotated in a comment for human readability. This ensures the workflow always uses an immutable, auditable version of the action.

This is a minimal, one-line change. Ready for review.