chore: semgrep triage

Pass a constant format string to console.log in compare.mjs (same output).
Annotate the mutable action tags in the Windows fallback workflow with
nosemgrep; workflow behaviour is unchanged.

.gitea/workflows/windows-build.yml

@@ -13,13 +13,13 @@ jobs:
   build:
     runs-on: windows
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@stable # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
 
       - name: Install Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
         with:
           node-version: 20
 
@@ -30,7 +30,7 @@ jobs:
         run: npm run app:build
 
       - name: Upload installer
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v4 # nosemgrep: github-actions-mutable-action-tag -- fallback workflow, behavior unchanged
         with:
           name: voiced-windows
           path: src-tauri/target/release/bundle/nsis/*.exe