ci: pin third-party actions in update-changelog to commit SHAs

Pin stefanzweifel/changelog-updater-action (v1.12.0) and
git-auto-commit-action (v7.2.0) to full commit SHAs to remove the
mutable-tag supply-chain surface. Dependabot's github-actions ecosystem
keeps the SHAs current via reviewed PRs.

Author: MarketDataApp

.github/workflows/update-changelog.yml

@@ -19,13 +19,13 @@ jobs:
           ref: main
 
       - name: Update Changelog
-        uses: stefanzweifel/changelog-updater-action@v1
+        uses: stefanzweifel/changelog-updater-action@a938690fad7edf25368f37e43a1ed1b34303eb36 # v1.12.0
         with:
           latest-version: ${{ github.event.release.name }}
           release-notes: ${{ github.event.release.body }}
 
       - name: Commit updated CHANGELOG
-        uses: stefanzweifel/git-auto-commit-action@v7
+        uses: stefanzweifel/git-auto-commit-action@4a55954c782fc1ea30b9056cd3e7a2b40ca8887d # v7.2.0
         with:
           branch: main
           commit_message: Update CHANGELOG