Pin CI to the stable StackStorm release

[kszarek]

Summary

Scheduled builds currently track StackStorm master. The current development branch no longer provides the virtualenv command expected by the shared pack workflow, causing dependency setup to fail before the tests start.

This change:

• pins the shared reusable workflows to full commit SHAs;
• pins StackStorm to the stable v3.9.0 commit;
• updates the test matrix to Python 3.10 and 3.11;
• bumps the pack version to 3.3.1 as required by the pack metadata checks.

The same configuration is applied to both pull request and release workflows.

Validation

• Both workflow files parse as valid YAML.
• All reusable workflow references use full 40-character commit SHAs.
• The pinned StackStorm and shared workflow commits were verified against their remote repositories.
• The affected Pylint checks pass with a score of 10.00/10.

[CLAassistant]

All committers have signed the CLA.

[floatingstatic]

@cognifloyd do you have admin access to this repo? I think we may have a branch protection rule in place that requires "Build and Test / Python 3.8" to pass before I can merge anything here but I do not have access to this. Also any chance we can get StackStorm-Exchange/ci#160 reviewed and merged by the st2 team to avoid pinning to a specific sha here as workaround?

[floatingstatic]

@kszarek Just an FYI I'm trying to figure out how to get the py38 test requirement dropped (see comments above). I will look at your other PR after we get this sorted out as it seems to be a prerequisite here.