Pin GitHub Actions to commit SHAs

[neonspectra]

Summary

Pins GitHub Actions uses: references to verified full-length commit SHAs.

This prepares the repository for orgwide enforcement that blocks unpinned GitHub Actions and reduces supply-chain risk from mutable tags or branches.

Details

• Replaced mutable external action refs such as owner/action@vN with full 40-character commit SHAs.
• Preserved the originally intended tag/version as an inline comment next to each pin.
• Resolved SHAs from the official upstream action repositories using git ls-remote.
• For annotated tags, pinned the peeled commit SHA (refs/tags/<tag>^{}), not the tag object SHA.
• No workflow behavior, inputs, permissions, or triggers were intentionally changed.

[iperzic]

Code LGTM, but I'm not sure whether CI failures have something to do with the changes?

[neonspectra]

They were failing on the previous commit to master. Not related to anything as far as I can see. All this change does is pins the workflows to the version they're tagged as.