ci: move changed-files off the CVE-2025-30066 affected v41

request-review.yml still referenced tj-actions/changed-files@v41, the
action and version range hit by the March 2025 supply chain compromise
(GHSA-mrrh-fwg8-r2c3): the attacker re-pointed existing version tags at
code that dumped the runner's memory, including the job's GITHUB_TOKEN,
into the public build logs.

Bump to v46.0.5, pinned by commit SHA so the ref cannot be re-pointed
again; the two other call sites already on v46 get the same pin in the
next commit. The action's file-matching API is unchanged between v41
and v46 for the patterns used here.

.github/workflows/request-review.yml

@@ -19,7 +19,7 @@ jobs:
           ref: refs/pull/${{ github.event.pull_request.number }}/merge
       - name: Get changed files
         id: changed-files
-        uses: tj-actions/changed-files@v41
+        uses: tj-actions/changed-files@ed68ef82c095e0d48ec87eccea555d944a631a4c # v46.0.5
         with:
           files: icons/*.svg
       - run: |