* Move CI to Python 3.11, with the version set in `.python-version`
- `.python-version` is the single source of the CI Python version.
- GitHub Actions workflows use `python-version-file: .python-version`.
- The CPU CI images now build on a shared `docker/ci-base.dockerfile`
via `docker/docker-bake.hcl`; the build workflows pass
`PYTHON_VERSION` from `.python-version`. Same for the doc-builder image.
- consistency image: `pypi-kenlm` doesn't build on 3.11, use `kenlm`
(needs cmake).
- `check_circleci_user` only runs shell, use `cimg/base:stable`.
* fix(ci): harden GitHub Actions workflows (#49311) (#49312)
fix(ci): harden workflow files flagged on #49311
Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
* dev-ci
* [test all] [build-ci-image]
---------
Co-authored-by: hf-security-analysis[bot] <265538906+hf-security-analysis[bot]@users.noreply.github.com>
