Pin Psalm version for security analysis

The action will otherwise pull dev-master and this can break easily as
we just experience.

Signed-off-by: Christoph Wurst <christoph@winzerhof-wurst.at>