ci: fix main SonarCloud quality gate findings

[krowvin]

Main's SonarCloud quality gate fails on three reliability findings and ten unpinned workflow dependencies. This fixes the reported findings without changing the runtime API.

• Let deletion assertions and unexpected API errors fail the level tests. Verify the temporary dated level exists before deleting it, then check that CDA no longer returns that effective date; CDA can legitimately fall back to the previous level. Verify deleted specified levels are absent from the returned list.
• Iterate office collections with FIRST/NEXT so database setup handles empty or sparse collections.
• Pin the six flagged third-party Actions to the commits currently referenced by their existing tags.

Validation: 98 mock/doctest tests, strict mypy, pre-commit, and actionlint pass locally. All eight normal PR checks pass, including SonarCloud, CodeQL, and Python 3.9/latest unit tests. Failure probes confirm that undeleted data, HTTP 500, and unexpected errors fail, while the previous effective level and HTTP 404 are accepted. The corrected tests pass all 80 integration tests on Python 3.9 with production CDA and production schema. The remaining combinations in the full matrix are still running: https://github.com/HydrologicEngineeringCenter/cwms-python/actions/runs/34545073336.

[github-actions]

This PR changes Python files, and the title does not match the release naming convention used by release-please.

Consider renaming the PR title to one of these forms:

• fix: short description (patch)
• feat: short description (minor)
• feat!: short description (major)

If this PR will be squash-merged, the PR title often becomes the commit message on the default branch, which affects whether the next release is patch, minor, or major.

Scoped titles such as fix(parser): handle missing values are also supported. This is an advisory reminder; tests, docs, and maintenance-only changes can use their appropriate Conventional Commit type.

See the repository guidance in CONTRIBUTING.md.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud