windows-check: Pin wolfssl to v5.9.1-stable in mingw-regress

The wolfssl checkout in mingw-regress had no ref, so it always built
against wolfssl/wolfssl's default branch. An upstream change there
could break this job with nothing changed on the wolfssh side to
explain it, and this job in particular turned out to be sensitive to
exact wolfSSL build details while it was being brought up.

Pin it to v5.9.1-stable, the same tag singlethread-check.yml and
x509-interop.yml already use, confirmed to include wc_mlkem.c so the
ML-KEM coverage this job exercises is still built. The build and
asan-tests jobs in this file have the same unpinned checkout but are
left alone here, since they were not touched by this change.

.github/workflows/windows-check.yml

@@ -240,6 +240,12 @@ jobs:
     runs-on: windows-latest
     timeout-minutes: 40
 
+    # Pinned rather than left on wolfssl/wolfssl's default branch, so an
+    # upstream wolfSSL change can't silently break this job. Matches the
+    # ref singlethread-check.yml and x509-interop.yml already pin to.
+    env:
+      WOLFSSL_REF: v5.9.1-stable
+
     defaults:
       run:
         shell: msys2 {0}
@@ -261,6 +267,7 @@ jobs:
       uses: actions/checkout@v4
       with:
         repository: wolfssl/wolfssl
+        ref: ${{ env.WOLFSSL_REF }}
         path: wolfssl
 
     - name: Build and install wolfssl