ci: pin third-party actions to Apache-approved SHAs (apache#2266)

## Which issue does this PR close?

<!--
We generally require a GitHub issue to be filed for all bug fixes and
enhancements and this helps us generate change logs for our releases.
You can link an issue to this PR using the GitHub syntax. For example
`Closes apache#123` indicates that this PR will close issue apache#123.
-->

- Closes #.

## What changes are included in this PR?
Pin `astral-sh/setup-uv` to commit SHAs from Apache's
[infrastructure-actions
allowlist](https://github.com/apache/infrastructure-actions/blob/07f5f9d2b05fe0ec9886e3ef0a9d79797817f0cb/approved_patterns.yml#L9)

Fixes apache/infrastructure-actions#550

<!--
Provide a summary of the modifications in this PR. List the main changes
such as new features, bug fixes, refactoring, or any other updates.
-->

## Are these changes tested?

<!--
Specify what test covers (unit test, integration test, etc.).

If tests are not included in your PR, please explain why (for example,
are they covered by existing tests)?
-->

(cherry picked from commit 99dbb16)

Author: kevinjqliu

.github/workflows/bindings_python_ci.yml

@@ -59,7 +59,7 @@ jobs:
     runs-on: ubuntu-slim
     steps:
       - uses: actions/checkout@v6
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
         with:
           version: "0.9.3"
           enable-cache: true
@@ -94,7 +94,7 @@ jobs:
           working-directory: "bindings/python"
           command: build
           args: --out dist
-      - uses: astral-sh/setup-uv@v7
+      - uses: astral-sh/setup-uv@5a095e7a2014a4212f075830d4f7277575a9d098
         with:
           version: "0.9.3"
           enable-cache: true