ci: checkout the repo before detecting workflow changes in security-scan

[sbldevnet]

Summary

• security-scan.yml's changes job runs dorny/paths-filter without checking out the repo, so on push events (which need local git history) it fails with git rev-parse --abbrev-ref HEAD exit code 128, cascading to zizmor (which needs: changes).
• Add an actions/checkout step (pinned by SHA, matching the rest of the repo's workflows) with fetch-depth: 2 before the Detect workflow changes step.

Test plan

• changes job succeeds on pull_request events
• changes job succeeds on push events to main
• A commit that does not touch .github/workflows/** yields workflows=false
• A commit that touches a workflow file yields workflows=true and zizmor runs