[llvm] [CI] Pin runners to us-west cluster (PR #217111)

[via llvm-commits]

================
@@ -24,24 +24,28 @@
 
 jobs:
   premerge-checks-linux:
-    name: Build and Test Linux${{ (startsWith(matrix.runs-on, 'depot-ubuntu-24.04-arm') && ' AArch64') || '' }}
+    name: Build and Test Linux${{ (startsWith(matrix.name, 'depot-ubuntu-24.04-arm') && ' AArch64') || '' }}
     if: >-
         github.repository_owner == 'llvm' &&
         (github.event_name != 'pull_request' || github.event.action != 'closed')
     strategy:
       fail-fast: false
       matrix:
-        runs-on:
-          - depot-ubuntu-24.04-arm-16
-          - llvm-premerge-linux-runners
+        include:
+          - name: depot-ubuntu-24.04-arm-16
+            runs-on: depot-ubuntu-24.04-arm-16
+          - name: llvm-premerge-linux-runners
+            runs-on:
+              labels: llvm-premerge-linux-runners
+              group: llvm-premerge-cluster-us-west
     runs-on: ${{ matrix.runs-on }}
     container:
       # The llvm-premerge agents are already containers and running the
       # this same image, so we can't use a container for the github action
       # job.  The depot containers are running on VMs, so we can use a
       # container.  This helps ensure the build environment is as close
       # as possible on both the depot runners and the llvm-premerge runners.
-      image: ${{ (startsWith(matrix.runs-on, 'depot-ubuntu-24.04-arm') && format('ghcr.io/{0}/arm64v8/ci-ubuntu-24.04',github.repository_owner) ) || null }}
+      image: ${{ (startsWith(matrix.name, 'depot-ubuntu-24.04-arm') && format('ghcr.io/{0}/arm64v8/ci-ubuntu-24.04',github.repository_owner) ) || null }}
----------------
github-advanced-security[bot] wrote:

## zizmor / 

unpinned image references: container image may be unpinned

[Show more details](https://github.com/llvm/llvm-project/security/code-scanning/2309)

https://github.com/llvm/llvm-project/pull/217111