chore: repo cleanup - pin actions, fix typos, improve gitignore

- build.yml: pin push-to-registry to SHA
- build-installer-iso.yml: pin checkout/upload-artifact to SHA,
  replace hardcoded registry with env vars, add env block
- Justfile: fix 'Virtal' typo (10x), fix shfmt error msg,
  quote $file in check/fix recipes
- .gitignore: add *.iso, *.qcow2, *.raw, .env, *.log
- iso/config.toml: remove leading space
- Containerfile: remove non-existent /tmp/build from cleanup
- build/50-prepare-flatpak-for-bazaar.sh: add executable permission
- build/README.md: update to reflect current script names

.github/workflows/build.yml

@@ -130,7 +130,7 @@ jobs:
       - name: Push to GHCR
         id: push
         if: github.event_name != 'pull_request' && github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
-        uses: redhat-actions/push-to-registry@v2
+        uses: redhat-actions/push-to-registry@5ed88d269cf581ea9ef6dd6806d01562096bee9c # v2
         with:
           image: ${{ env.IMAGE_NAME }}
           tags: ${{ steps.metadata.outputs.tags }}