ci: switch to step-security/msvc-dev-cmd fork (Node.js 24)

The upstream ilammy/msvc-dev-cmd is unmaintained and still runs on
Node.js 20, which GitHub Actions is deprecating (removal on
September 16th, 2026). step-security/msvc-dev-cmd@v1.13.1 is a
maintained fork upgraded to Node.js 24.

coverage.yml also gains SHA pinning; it was previously tag-pinned
to @v1.

Author: leofang

.github/workflows/build-wheel.yml

@@ -85,7 +85,7 @@ jobs:
 
       - name: Set up MSVC
         if: ${{ startsWith(inputs.host-platform, 'win') }}
-        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1
+        uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Set up yq
         # GitHub made an unprofessional decision to not provide it in their Windows VMs,

.github/workflows/coverage.yml

@@ -212,7 +212,7 @@ jobs:
           python-version: ${{ env.PY_VER }}
 
       - name: Set up MSVC
-        uses: ilammy/msvc-dev-cmd@v1
+        uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Set up mini CTK
         uses: ./.github/actions/fetch_ctk

.github/workflows/test-sdist-windows.yml

@@ -45,7 +45,7 @@ jobs:
           python-version: "3.12"
 
       - name: Set up MSVC
-        uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756  # v1
+        uses: step-security/msvc-dev-cmd@22c98154b708dbd743e6f27a933cf6ceba3305c4  # v1.13.1
 
       - name: Install build tools
         run: pip install build