ci: Pin fsfe/reuse-action, coverallsapp to commit hash

Author: RandomByte

.github/workflows/coverage.yml

@@ -42,7 +42,7 @@ jobs:
       run: npm run coverage
 
     - name: Send parallel reports to Coveralls for all packages
-      uses: coverallsapp/github-action@v2.3.7
+      uses: coverallsapp/github-action@648a8eb78e6d50909eff900e4ec85cab4524a45b # v2.3.6
       continue-on-error: true # Do not fail the job if coverage reporting fails (e.g. service is down)
       with:
         parallel: true

.github/workflows/reuse-compliance.yml

@@ -32,7 +32,7 @@ jobs:
     # Check each package if compliance is correctly set up.
     # Each one of these packages would be published separately.
     - name: Execute REUSE Compliance Check for ${{ matrix.package }}
-      uses: fsfe/reuse-action@v6
+      uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
       with:
         args: --root ${{ matrix.package }} lint