Pin codeowner-review-request checkout to base SHA

Explicitly checkout the base branch SHA for consistency and to
ensure the shared codeowners.js script is always loaded from
trusted code, not the PR head.

.github/workflows/codeowner-review-request.yml

@@ -24,8 +24,10 @@ jobs:
     if: ${{ github.repository == 'esphome/esphome' && !github.event.pull_request.draft }}
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
+      - name: Checkout base branch
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event.pull_request.base.sha }}
 
       - name: Request reviews from component codeowners
         uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0