fix(security): use self-repository syntax in extensions-cli workflow

zizmor's `self-repository` audit flags the workspace-relative `./...` refs
to in-repo actions in the extensions-cli test workflow: GitHub has a
dedicated `$/...` syntax for referencing an action that lives in the same
repository being checked out. This matches the fix already applied to the
same pair of actions (change-detector, setup-backend) in other workflows
(e.g. superset-translations.yml, and open PRs for helm-lint-test.yml and
testcontainers.yml).

Resolves code-scanning alert #2639, and incidentally alert #2638 for the
sibling change-detector ref on the adjacent line.

Co-Authored-By: Evan Rusackas <evan@preset.io>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/superset-extensions-cli.yml

@@ -39,13 +39,13 @@ jobs:
 
       - name: Check for file changes
         id: check
-        uses: ./.github/actions/change-detector/
+        uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Python
         if: steps.check.outputs.superset-extensions-cli
-        uses: ./.github/actions/setup-backend/
+        uses: $/.github/actions/setup-backend/
         with:
           python-version: ${{ matrix.python-version }}
           requirements-type: dev