Fix remaining AGPL SPDX in Rust files and SHA-pin nested workflow actions

- AGPL-3.0-or-later → PMPL-1.0-or-later in .rs source files
- SHA-pin remaining checkout@v2/v3, upload-artifact@v3, cache@v3,
  setup-node@v3 in nested/submodule workflow files

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

asdf-acceleration-middleware/.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
       - run: cargo doc --all --no-deps
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4
         with:
           name: documentation
           path: target/doc/

asdf-acceleration-middleware/.github/workflows/release.yml

@@ -75,7 +75,7 @@ jobs:
           fi
         shell: bash
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4
         with:
           name: ${{ matrix.target }}
           path: release/*

asdf-augmenters/asdf-acceleration-middleware/.github/workflows/ci.yml

@@ -107,7 +107,7 @@ jobs:
       - uses: dtolnay/rust-toolchain@stable
       - uses: Swatinem/rust-cache@779680da715d629ac1d338a641029a2f4372abb5 # v2
       - run: cargo doc --all --no-deps
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4
         with:
           name: documentation
           path: target/doc/

asdf-augmenters/asdf-acceleration-middleware/.github/workflows/release.yml

@@ -75,7 +75,7 @@ jobs:
           fi
         shell: bash
 
-      - uses: actions/upload-artifact@v3
+      - uses: actions/upload-artifact@ea165f8d65b6db9a8b71b5c2d1a090c0daf9c8bb # v4
         with:
           name: ${{ matrix.target }}
           path: release/*