workflows: pin msys2/setup-msys2 action to a specific commit hash

Replace the mutable tag reference 'msys2/setup-msys2@v2' with a pinned
commit SHA in zephyr.yml.

Why this is recommended:
Tags in GitHub Actions are mutable - a repository owner can silently
move a tag (e.g. 'v2') to point to a different, potentially malicious
commit at any time without the consuming workflow receiving any
notification. Pinning to a full commit SHA ensures the exact code that
was reviewed is what runs in CI, making the reference immutable.

Threats prevented:
- Supply chain attacks: a compromised or malicious actor with write
  access to the msys2/setup-msys2 repository cannot push new code under
  the existing 'v2' tag and have it automatically executed in our CI
  without an explicit code review and hash update on our side.
- Dependency confusion: prevents accidental or forced resolution to an
  unintended version of the action.

The comment '# v2' is retained to make it clear which upstream release
the hash corresponds to, aiding future maintenance when a deliberate
update is needed.

Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>

Author: tmleman

.github/workflows/zephyr.yml

@@ -398,7 +398,7 @@ jobs:
       # https://github.com/actions/runner-images/blob/win22/20230918.1/images/win/Windows2022-Readme.md
       # Is it not good enough? Maybe it could save 20-30s.
       - name: Initialize MSYS2
-        uses: msys2/setup-msys2@v2
+        uses: msys2/setup-msys2@cafece8e6baf9247cf9b1bf95097b0b983cc558d  # v2
         with:
           msystem: MSYS
           install: gcc openssl-devel