fix(ci): pin more ci actions (#3578)

## Why?



## What does this PR do?



## Related issues



## AI Contribution Checklist



- [ ] Substantial AI assistance was used in this PR: `yes` / `no`
- [ ] If `yes`, I included a completed [AI Contribution
Checklist](https://github.com/apache/fory/blob/main/AI_POLICY.md#9-contributor-checklist-for-ai-assisted-prs)
in this PR description and the required `AI Usage Disclosure`.
- [ ] If `yes`, my PR description includes the required `ai_review`
summary and screenshot evidence of the final clean AI review results
from both fresh reviewers on the current PR diff or current HEAD after
the latest code changes.



## Does this PR introduce any user-facing change?



- [ ] Does this PR introduce any public API change?
- [ ] Does this PR introduce any binary protocol compatibility change?

## Benchmark

Author: chaokunyang

.github/workflows/release-rust.yaml

@@ -33,7 +33,7 @@ jobs:
     steps:
       - uses: actions/checkout@v5
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8  # stable
 
       - name: Bump rust version
         shell: bash

javascript/packages/core/package.json

@@ -2,6 +2,7 @@
   "name": "@apache-fory/core",
   "version": "0.17.0-alpha.0",
   "description": "Apache Fory™ is a blazingly fast multi-language serialization framework powered by jit and zero-copy",
+  "homepage": "https://fory.apache.org/docs/guide/javascript",
   "main": "dist/index.js",
   "scripts": {
     "build": "tsc",

javascript/packages/hps/package.json

@@ -2,6 +2,7 @@
   "name": "@apache-fory/hps",
   "version": "0.17.0-alpha.0",
   "description": "Apache Fory™ nodejs high-performance suite",
+  "homepage": "https://fory.apache.org/docs/guide/javascript",
   "main": "dist/index.js",
   "files": [
     "dist",