chore: pin third-party GitHub Actions to commit SHAs (#510)

## Summary

Pin all third-party GitHub Actions to full-length commit SHAs to prevent
supply chain attacks.

Addresses findings from the
[`third-party-action-not-pinned-to-commit-sha`](https://github.com/launchdarkly/semgrep-rules/blob/main/github-actions/third-party-action-not-pinned-to-commit-sha.yml)
Semgrep rule.

## Test plan

- [ ] Verify CI passes with pinned action SHAs

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk change that only updates GitHub Actions references to
immutable commit SHAs; the main risk is CI/release packaging breaking if
the pinned revisions are incorrect or later removed.
> 
> **Overview**
> Pins third-party GitHub Actions used by the `sdk-release` composite
action to full commit SHAs (notably `thedoctor0/zip-release` and
`ilammy/msvc-dev-cmd`) to reduce supply-chain risk while keeping the
referenced versions the same.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
508322c. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: pkaeding

.github/actions/sdk-release/action.yml

@@ -73,15 +73,15 @@ runs:
 
     - name: Archive Release Linux - GCC/x64/Static
       if: runner.os == 'Linux'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static/release'
         type: 'zip'
         filename: 'linux-gcc-x64-static.zip'
 
     - name: Archive Release Linux - GCC/x64/Dynamic
       if: runner.os == 'Linux'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic/release'
         type: 'zip'
@@ -100,15 +100,15 @@ runs:
 
     - name: Archive Release Linux - GCC/x64/Static/CURL
       if: runner.os == 'Linux'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static-curl/release'
         type: 'zip'
         filename: 'linux-gcc-x64-static-curl${{ steps.curl-suffix-linux.outputs.suffix }}.zip'
 
     - name: Archive Release Linux - GCC/x64/Dynamic/CURL
       if: runner.os == 'Linux'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic-curl/release'
         type: 'zip'
@@ -141,7 +141,7 @@ runs:
 
     - name: Configure MSVC
       if: runner.os == 'Windows'
-      uses: ilammy/msvc-dev-cmd@v1
+      uses: ilammy/msvc-dev-cmd@0b201ec74fa43914dc39ae48a89fd1d8cb592756 # v1
 
     - name: Build Windows Artifacts (Boost.Beast)
       if: runner.os == 'Windows'
@@ -165,31 +165,31 @@ runs:
 
     - name: Archive Release Windows - MSVC/x64/Static
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static/release'
         type: 'zip'
         filename: 'windows-msvc-x64-static.zip'
 
     - name: Archive Release Windows - MSVC/x64/Dynamic
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic/release'
         type: 'zip'
         filename: 'windows-msvc-x64-dynamic.zip'
 
     - name: Archive Release Windows - MSVC/x64/Static/Debug
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static-debug/release'
         type: 'zip'
         filename: 'windows-msvc-x64-static-debug.zip'
 
     - name: Archive Release Windows - MSVC/x64/Dynamic/Debug
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic-debug/release'
         type: 'zip'
@@ -208,31 +208,31 @@ runs:
 
     - name: Archive Release Windows - MSVC/x64/Static/CURL
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static-curl/release'
         type: 'zip'
         filename: 'windows-msvc-x64-static-curl${{ steps.curl-suffix-windows.outputs.suffix }}.zip'
 
     - name: Archive Release Windows - MSVC/x64/Dynamic/CURL
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic-curl/release'
         type: 'zip'
         filename: 'windows-msvc-x64-dynamic-curl${{ steps.curl-suffix-windows.outputs.suffix }}.zip'
 
     - name: Archive Release Windows - MSVC/x64/Static/Debug/CURL
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static-debug-curl/release'
         type: 'zip'
         filename: 'windows-msvc-x64-static-debug-curl${{ steps.curl-suffix-windows.outputs.suffix }}.zip'
 
     - name: Archive Release Windows - MSVC/x64/Dynamic/Debug/CURL
       if: runner.os == 'Windows'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic-debug-curl/release'
         type: 'zip'
@@ -278,15 +278,15 @@ runs:
 
     - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Static
       if: runner.os == 'macOS'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static/release'
         type: 'zip'
         filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-static.zip'
 
     - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Dynamic
       if: runner.os == 'macOS'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic/release'
         type: 'zip'
@@ -305,15 +305,15 @@ runs:
 
     - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Static/CURL
       if: runner.os == 'macOS'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-static-curl/release'
         type: 'zip'
         filename: 'mac-clang-${{ inputs.mac_artifact_arch }}-static-curl${{ steps.curl-suffix-macos.outputs.suffix }}.zip'
 
     - name: Archive Release Mac - AppleClang/${{ inputs.mac_artifact_arch }}/Dynamic/CURL
       if: runner.os == 'macOS'
-      uses: thedoctor0/zip-release@0.7.1
+      uses: thedoctor0/zip-release@a24011d8d445e4da5935a7e73c1f98e22a439464 # 0.7.1
       with:
         path: 'build-dynamic-curl/release'
         type: 'zip'