fix(ci): move scan-and-report's rust-toolchain pin to the current v1 commit

02cb101e was v1 when it was pinned; v1 now points at 683b588c and no tag
names 02cb101e any more. Callers of this reusable (echidna security-scan)
must lock it, and the estate repair chain (close-lock) records a leaf SHA
only through a tag, so the old pin left them unlockable and failing at
startup. The lock is regenerated in the next commit by the repair chain.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019a95kk88TZ1iegsBK3kox3

Author: claude

.github/workflows/scan-and-report.yml

@@ -39,7 +39,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
+        uses: dtolnay/rust-toolchain@683b588c487a69d01f6c6ddf40f036ff682cc2c8 # v1
         with:
           toolchain: stable