ci: pin docker/* actions to commit SHAs

The org requires all actions pinned to a full-length commit SHA.
Pin docker/login-action, docker/setup-buildx-action and
docker/build-push-action (same major versions) to their release SHAs.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cybercyst

.github/workflows/build-and-release.yaml

@@ -18,13 +18,13 @@ jobs:
           fetch-depth: 0
 
       - name: Login to Docker Hub
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           username: dockerbuildbot
           password: ${{ secrets.DOCKERBUILDBOT_READ_PAT }}
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
         with:
           driver: cloud
           endpoint: docker/platform-experience
@@ -47,7 +47,7 @@ jobs:
 
       - name: Build and Push Docker Image
         id: docker-build
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           platforms: linux/amd64