fix(ci): SHA-pin the four actions in pages.yml

The workflow security linter's SPDX gate passed after d3f61c7 and
immediately revealed the next one: pages.yml was the only workflow in the
repo with tag-ref actions (4 of 66 `uses:`). It had never actually run --
its single run ever was the BROKEN-M1 startup_failure -- so nothing had
ever exercised the linter against it.

  actions/checkout            -> de0fac2e (v6.0.2), the pin 41 other
                                 workflows in this repo already use
  actions/upload-pages-artifact -> 56afc609 (v3.0.1), = current @V3
  actions/deploy-pages          -> d6db9016 (v4.0.5), = current @v4

The latter two are pin-only: the SHAs are exactly what the tags resolve
to today, so no behaviour changes. checkout moves v4 -> v6.0.2 to match
the rest of the repo; note pages.yml is the only container job here, so
this is the first time that pin runs inside idris2-pack.

Verified locally: 66/66 `uses:` SHA-pinned, 25/25 workflows carry SPDX +
top-level permissions, all 25 parse as YAML.

Author: hyperpolymath

.github/workflows/pages.yml

@@ -23,9 +23,9 @@ jobs:
       image: ghcr.io/stefan-hoeck/idris2-pack@sha256:f0758996a931fb35d9ecb1de273c4d59dabe2a09b433afc7e357f65a08b7e1ff
     steps:
       - name: Checkout Site
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
       - name: Checkout Ddraig SSG
-        uses: actions/checkout@v4
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           repository: hyperpolymath/ddraig-ssg
           path: .ddraig-ssg
@@ -42,7 +42,7 @@ jobs:
           fi
           ./.ddraig-ssg/build/exec/ddraig build src _site https://hyperpolymath.github.io/${GITHUB_REPOSITORY#*/}
       - name: Upload artifact
-        uses: actions/upload-pages-artifact@v3
+        uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
         with:
           path: '_site'
   deploy:
@@ -55,4 +55,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5