chore: pin GitHub Actions to specific commit SHAs (#422)

Use pinact to pin all workflow actions to immutable commit SHAs
instead of mutable tags to prevent supply chain attacks.

Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>

Author: julian-risch

.github/workflows/CI_project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add new issues to the project for triage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v0.5.0
+      - uses: actions/add-to-project@31b3f3ccdc584546fc445612dec3f38ff5edb41c # v0.5.0
         with:
           project-url: https://github.com/orgs/deepset-ai/projects/5
           github-token: ${{ secrets.GH_PROJECT_PAT }}

.github/workflows/project.yml

@@ -10,7 +10,7 @@ jobs:
     name: Add new issues to project for triage
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/add-to-project@v1.0.2
+      - uses: actions/add-to-project@244f685bbc3b7adfa8466e08b698b5577571133e # v1.0.2
         with:
           project-url: https://github.com/orgs/deepset-ai/projects/5
           github-token: ${{ secrets.GH_PROJECT_PAT }}