security: harden spawn callbacks and workflows

[pushkart2]

What changed

• rate-limit each spawn database callback per player
• validate player lifecycle, query results, and decoded coordinates before returning spawn data
• replace the privileged pull_request_target lint trigger with pull_request
• preserve JUnit reports for trusted pushes/PRs while fork PRs lint with a read-only token
• pin all workflow actions, declare least-privilege permissions, and package releases from the pushed tag

Why

The spawn callbacks performed a database query on every invocation and dereferenced player/query/JSON data without validation. Separately, the lint workflow checked out contributor-controlled code in a privileged pull_request_target context; CodeQL flags that path as high severity. Mutable action tags and implicit token permissions increased the workflow supply-chain exposure.

Impact

Normal spawn setup still makes one request to each callback; duplicate requests in the same second fail closed. Contributor PRs keep Lua lint coverage without privileged code execution, and trusted runs keep the standalone lint report.

Validation

• actionlint 1.7.12
• workflow YAML and immutable-reference validation
• git diff --check
• direct Lua syntax/control-flow review
• GitHub CodeQL, Lint Resource, and Linting Report: success