ci: pin safe-chain to v1.4.7 and reduce minimum package age to 72h

[mdeliatf]

Description

• Pin safe-chain to v1.4.7 instead of always pulling latest, the install script is downloaded from a specific release and verified with a SHA-512 checksum before execution, preventing supply chain attacks via a compromised installer.
• Reduce SAFE_CHAIN_MINIMUM_PACKAGE_AGE_HOURS from 360 to 72 (3 days).

Fix https://github.com/traefik/hub-issues/issues/2782

Good PR checkboxes

• Change has been tested
• Added/Updated tests
• Added/Updated stories
• PR follows conventions
• Labels are set
• Project is linked

Good Review checkboxes

ℹ️ Copy the snippet and paste in the review field to fill it

- [ ] I've tested the changes
- [ ] I've agreed on the unit tests (soon to come)
- [ ] I've checked the stories
- [ ] I've read the code and understood it
- [ ] I don't have any more questions
- [ ] I've described any optional improvements
- [ ] I checked PR follows [conventions](https://github.com/traefik/faency#how-to-contribute)

[darkweaver87]

LGTM

[gndz07]

LGTM

[github-actions]

🎉 This PR is included in version 12.1.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀