trivy-action fails because not all actions are pinned

After updating `trivy-action` to `v0.33.0` (https://github.com/dani-garcia/vaultwarden/pull/6248) the workflow still fails because `setup-trivy` does not have its actions pinned:
<img width="777" height="75" alt="image" src="https://github.com/user-attachments/assets/f3275c5a-9924-412c-b311-38a90c50ae1c" />