ci: pin build-kits workflow actions to commit SHAs

Fix semgrep blocking findings for mutable GitHub Actions tag references.

Author: denischilik

.github/workflows/build-kits.yml

@@ -14,7 +14,7 @@ jobs:
     outputs:
       matrix: ${{ steps.set.outputs.matrix }}
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           sparse-checkout: kits/matrix.json
           sparse-checkout-cone-mode: false
@@ -31,15 +31,15 @@ jobs:
         kit: ${{ fromJson(needs.load-matrix.outputs.matrix) }}
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Set SDK version
         run: |
           echo "ORG_GRADLE_PROJECT_VERSION=$(head -n 1 VERSION)" >> $GITHUB_ENV
           echo "ORG_GRADLE_PROJECT_version=$(head -n 1 VERSION)" >> $GITHUB_ENV
 
       - name: Install JDK 17
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@ad2b38190b15e4d6bdf0c97fb4fca8412226d287 # v5
         with:
           distribution: zulu
           java-version: "17"