chore: add workaround CVE-2026-31431

[chilcano]

Adds a kernel module blacklist step as the first step in every job as a workaround for CVE-2026-31431.

[chilcano]

FYI @Seth-Schmidt - This is the output in my side once applied the patch.

zama-ai/protocol-apps
  applied: claude-review.yml
  applied: codeql.yml
  applied: common-pull-request-lint.yml
  applied: contracts-check-selectors.yml
  applied: contracts-confidential-token-wrappers-registry-tests.yml
  applied: contracts-confidential-wrapper-tests.yml
  applied: contracts-fees-burner-tests.yml
  applied: contracts-governance-tests.yml
  applied: contracts-pauser-set-wrapper-tests.yml
  applied: contracts-safe-hardhat-tests.yml
  applied: contracts-solana-oft-tests.yml
  applied: contracts-staking-hardhat-tests.yml
  applied: contracts-token-tests.yml
  applied: unverified_prs.yml

Workflows: 14 found, 14 updated, 0 skipped.

[Seth-Schmidt]

Looks good!