#432 Pin gradle/actions/setup-gradle to commit SHA

SonarCloud's GitHub Actions rule S7637 flags `uses: …@<tag>` as a
supply-chain risk: a compromised tag could rewrite the action's
implementation on the next workflow run. Pin to the commit SHA the
v4 tag points at today (gradle/actions v4.4.3, commit
48b5f213c81028ace310571dc5ec0fbbca0b2947) and keep a trailing
`# v4.4.3` comment so the version stays human-readable.

Without this, the bugfix/405 PR analysis hits sonar.qualitygate.wait
on the unreviewed-new-hotspot metric and fails the build.

Author: ascheman

.github/workflows/gradle-build.yml

@@ -44,7 +44,10 @@ jobs:
           java-version: '17'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        # Pin to commit SHA per SonarCloud rule githubactions:S7637 (supply-chain hardening).
+        # Update both the SHA and the comment together when bumping; verify the SHA at
+        # https://github.com/gradle/actions/releases.
+        uses: gradle/actions/setup-gradle@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4.4.3
         with:
           cache-read-only: true