Label the setup-php pin in ci.yml with its tag

Upstream moved setup-php's v2 tag, so the "# v2" comment on the
2.37.2 commit pin now fails the Audit GitHub Actions check
(ref-version-mismatch). Same change as #1118.

Assisted-by: Claude Code:claude-opus-5-5

Author: claude

.github/workflows/ci.yml

@@ -1397,7 +1397,7 @@ jobs:
         # The composer capstones shell out to a real composer; `composer:`
         # pins the release line (1, 2.2 LTS, 2) so the composer.lock grammar
         # the edits assert stays stable across runners.
-        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # v2
+        uses: shivammathur/setup-php@f3e473d116dcccaddc5834248c87452386958240 # 2.37.2
         with:
           php-version: '8.2'
           tools: composer:${{ matrix.composer }}