ci: pin ubuntu-latest to ubuntu-24.04 in merge-manifests and zizmor

ubuntu-latest is a moving target that can silently change the runner OS
  on the next GitHub-side update. All other jobs in this repo already pin
  to ubuntu-24.04; this makes merge-manifests and zizmor consistent.

.github/workflows/release.yml

@@ -244,7 +244,7 @@ jobs:
 
   merge-manifests:
     name: Merge manifests
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     needs: docker-build
     permissions:
       packages: write # Needed to upload packages and artifacts

.github/workflows/zizmor.yml

@@ -14,7 +14,7 @@ on:
 jobs:
   zizmor:
     name: Run zizmor
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-24.04
     permissions:
       security-events: write # To write the security report
     steps: