build: fixup build steps making use of *-latest os versions

[shoenig]

Not pinning our OS in workflow steps is how we get surprises at build/test/release time, and nobody likes those. Set these specifically to ubuntu-22.04 or whatever makes sense.

➜ rg 'runs-on:.*latest' *.yml
test-ui.yml
40:    runs-on: ubuntu-latest
62:    runs-on: ubuntu-latest
82:    runs-on: ubuntu-latest

semgrep.yml
11:    runs-on: ubuntu-latest

test-e2e.yml
39:    runs-on: ubuntu-latest

lock.yml
9:    runs-on: ubuntu-latest

build.yml
234:    runs-on: macos-latest

ember-test-audit.yml
16:    runs-on: ubuntu-latest
35:    runs-on: ubuntu-latest
53:    runs-on: ubuntu-latest

backport.yml
13:    runs-on: ubuntu-latest
38:    runs-on: ubuntu-latest

actionlint.yml
11:    runs-on: ubuntu-latest