more hardening of ci steps (#12834)

* fix rule: zizmor/self-repository

* pin to version

* fix --proto "=https"

* another shell:S6506

* fix shell:S8541

* fix githubactions:S8541

* fix githubactions:S8541

* more sec fixes

* fix psycopg version

* more script disabling on frontend

.github/workflows/translations.yaml

@@ -36,7 +36,7 @@ jobs:
         with:
           persist-credentials: false
       - name: Environment Setup
-        uses: ./.github/actions/setup
+        uses: $/.github/actions/setup
         with:
           install: true
           apt-dependency: gettext