ci: align validation with Fluent Bit consumers

[edsiper]

Summary

Align CFL's CI with the environments and downstream libraries used by Fluent
Bit.

• select and verify Clang correctly in the ARM64 matrix
• build cmetrics, ctraces, and Fluent Bit against the CFL commit under test
• enable Fluent Bit's content modifier, metrics selector, SQL, and sampling
  processors
• report the CFL version bundled by each downstream consumer
• declare GNU C99 as the default minimum and test GNU99 and GNU17
• pin actions and the analysis container to immutable revisions
• restrict default workflow permissions to read-only

Background

The ARM64 Clang job previously expanded CC to an empty value and therefore
ran GCC. CFL also had no downstream validation, so standalone tests could pass
even when a change could not be vendored into cmetrics, ctraces, or Fluent Bit.

Declaring the C standard before feature checks also prevents C11 APIs such as
timespec_get() from being detected under the compiler default and then
compiled into a GNU99 target.

Validation

• Actionlint passed for all workflows
• GNU99 CFL tests: 34/34 passed
• GNU17 CFL tests: 34/34 passed
• cmetrics with CFL HEAD: 20/20 tests passed
• ctraces with CFL HEAD: 4/4 tests passed
• Fluent Bit compiled with content modifier, metrics selector, SQL, and
  sampling processors
• git diff --check