chore(actions): address zizmor unpinned findings

Author: g-husam

.github/workflows/docs.yaml

@@ -24,7 +24,7 @@ jobs:
         python-version: '3.14'
     - run: pip install --no-deps --require-hashes -r .kokoro/docs/docker/requirements.txt
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: "8.2"
     - name: Extract phpDocumentor

.github/workflows/lint.yaml

@@ -26,7 +26,7 @@ jobs:
 
   style_csfixer:
     name: PHP CS Fixer
-    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main
+    uses: GoogleCloudPlatform/php-tools/.github/workflows/code-standards.yml@main # zizmor: ignore[unpinned-uses]
     with:
       config: GoogleCloudPlatform/php-tools/.php-cs-fixer.default.php@main
       exclude-patterns: |

.github/workflows/release-checks.yaml

@@ -45,7 +45,7 @@ jobs:
       - name: Get Latest Release
         if: github.event.pull_request.user.login == 'release-please[bot]'
         id: latest-release
-        uses: pozetroninc/github-action-get-latest-release@master
+        uses: pozetroninc/github-action-get-latest-release@2a61c339ea7ef0a336d1daa35ef0cb1418e7676c # v0.8.0
         with:
           repository: ${{ github.repository }}
           token: ${{ secrets.GITHUB_TOKEN }}
@@ -111,7 +111,7 @@ jobs:
 
   next-release-label-check:
     name: Check for "next release" label
-    uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main
+    uses: GoogleCloudPlatform/php-tools/.github/workflows/release-checks.yml@main # zizmor: ignore[unpinned-uses]
     if: github.event.pull_request.user.login == 'release-please[bot]'
     with:
       next-release-label-check: true

.github/workflows/release.yml

@@ -19,7 +19,7 @@ jobs:
           RELEASE_TAG: ${{ inputs.tag }}
         steps:
         - name: Clone libgit2
-          uses: actions/checkout@master
+          uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
           with:
             repository: libgit2/libgit2
             ref: v1.5.1
@@ -31,7 +31,7 @@ jobs:
             cmake .. -DCMAKE_INSTALL_PREFIX=/usr/local
             sudo cmake --build . --target install
         - name: Clone splitsh/lite
-          uses: actions/checkout@master
+          uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
           with:
             repository: splitsh/lite
             ref: v2.0.0

.github/workflows/system-tests.yaml

@@ -20,7 +20,7 @@ jobs:
           fetch-depth: 0
           persist-credentials: false
       - name: Setup PHP
-        uses: shivammathur/setup-php@verbose
+        uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
         with:
           php-version: "8.1"
           extensions: grpc

.github/workflows/unit-tests.yaml

@@ -52,7 +52,7 @@ jobs:
         restore-keys: ${{ steps.extcache.outputs.key }}
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: ${{ matrix.php }}
         extensions: sodium, sysvshm, ${{ matrix.extensions }}
@@ -80,7 +80,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: '8.1'
         extensions: grpc
@@ -95,7 +95,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: '8.1'
         extensions: grpc
@@ -112,7 +112,7 @@ jobs:
       with:
         persist-credentials: false
     - name: Setup PHP
-      uses: shivammathur/setup-php@verbose
+      uses: shivammathur/setup-php@verbose # zizmor: ignore[unpinned-uses]
       with:
         php-version: "8.2"
     - name: "Install dependencies"