fix(security): use self-repository syntax in frontend workflow

zizmor's self-repository audit flags the workspace-relative `./...`
form for referencing the in-repo change-detector action. GitHub's
`$/...` self-repository syntax is not subject to runtime filesystem
state and is treated as a pinned reference for policy enforcement.
Other workflows (e.g. superset-python-unittest.yml,
superset-playwright.yml) already use this form for the same action.

Resolves code-scanning alert #2640.

Co-Authored-By: Evan Rusackas <evan@preset.io>
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

.github/workflows/superset-extensions-cli.yml

@@ -39,13 +39,13 @@ jobs:
 
       - name: Check for file changes
         id: check
-        uses: $/.github/actions/change-detector/
+        uses: ./.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: Setup Python
         if: steps.check.outputs.superset-extensions-cli
-        uses: $/.github/actions/setup-backend/
+        uses: ./.github/actions/setup-backend/
         with:
           python-version: ${{ matrix.python-version }}
           requirements-type: dev

.github/workflows/superset-frontend.yml

@@ -41,7 +41,7 @@ jobs:
 
       - name: Check for File Changes
         id: check
-        uses: ./.github/actions/change-detector/
+        uses: $/.github/actions/change-detector/
         with:
           token: ${{ secrets.GITHUB_TOKEN }}