chore(deps): pin dependencies

Author: renovate[bot]

.github/actions/security-scans/action.yml

@@ -38,7 +38,7 @@ runs:
         accept-filenames: usr/share/postgresql-common/pgdg/apt.postgresql.org.asc,etc/ssl/private/ssl-cert-snakeoil.key,usr/local/lib/python3.9/dist-packages/azure/core/settings.py,usr/local/lib/python3.11/dist-packages/azure/core/settings.py,usr/local/lib/python3.13/dist-packages/azure/core/settings.py
 
     - name: Snyk
-      uses: snyk/actions/docker@master
+      uses: snyk/actions/docker@9adf32b1121593767fc3c057af55b55db032dc04 # master
       id: snyk
       if: ${{ inputs.snyk_token != '' }}
       # Snyk can be used to break the build when it detects vulnerabilities.

.github/workflows/bake_targets.yml

@@ -154,7 +154,7 @@ jobs:
       - name: Security checks
         # NOTE: Do not modify this to point to the local action "./.github/actions/security-scans",
         # as it will break workflows running bake_targets.yml (this workflow) from external repositories.
-        uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@main
+        uses: cloudnative-pg/postgres-containers/.github/actions/security-scans@bf14f80641c6b83cf4960fea9bab5d972c9e27e1 # main
         with:
           image: "${{ matrix.image }}"
           registry_user: ${{ github.actor }}
@@ -180,7 +180,7 @@ jobs:
       - name: Copy to production
         # NOTE: Do not modify this to point to the local action "./.github/actions/copy-images",
         # as it will break workflows running bake_targets.yml (this workflow) from external repositories.
-        uses: cloudnative-pg/postgres-containers/.github/actions/copy-images@main
+        uses: cloudnative-pg/postgres-containers/.github/actions/copy-images@bf14f80641c6b83cf4960fea9bab5d972c9e27e1 # main
         with:
           bake_build_metadata: "${{ needs.testbuild.outputs.metadata }}"
           registry_user: ${{ github.actor }}