[ci]: pin golangci-lint instead of tracking latest

lint.yml pins the action by SHA but asked it to install `version: latest`,
so the linter inside the pinned action was free to move. v2.13.0 did, and
all 29 lint jobs went red on code nobody had touched.

dependabot does not track this input, so bumps are manual: raise the
version and take the new findings in the same PR.