ci: pin third-party github actions to commit SHAs #277

Job	Run time
plan	16s
host	0s
build-local-artifacts (${{ join(matrix.targets, ', ') }})	0s
build-global-artifacts	-1s
custom-publish-homebrew	-1s
announce	-1s
	13s

Provide feedback