fix(ci): pin scorecard-action and codecov to commit SHAs, not tag objects

The OpenSSF Scorecard publish step at securityscorecards.dev was
failing with:

  workflow verification failed: imposter commit:
  99c09fe975337306107572b4fdf4db224cf8e2f2 does not belong to
  ossf/scorecard-action

Root cause: when PR-1 resolved the action SHAs, both ossf/scorecard-
action@v2.4.3 and codecov/codecov-action@v5.5.4 turned out to be
annotated tags. The `git/matching-refs/tags/<tag>` API returns the tag
object's SHA in that case, not the commit it points to. GitHub
Actions itself accepts either form, so CI ran fine — but the scorecard
publisher's "imposter commit" verifier rejects anything that isn't a
real commit on the action's repo.

Dereferenced both tags to their commit SHAs:

* ossf/scorecard-action @ v2.4.3
    99c09fe975337306107572b4fdf4db224cf8e2f2 (tag object)
  → 4eaacf0543bb3f2c246792bd56e8cdeffafb205a (commit)

* codecov/codecov-action @ v5.5.4
    aa56896cf108bd10b5eb883cd1d24196da57f695 (tag object)
  → 75cd11691c0faa626561e295848008c8a7dddffe (commit)

Verified each new SHA via `GET /repos/<owner>/<repo>/commits/<sha>`.
The codecov change is precautionary — codecov has no equivalent
verifier — but keeps the pinning style consistent across the repo.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: christiangda

.github/workflows/build.yml

@@ -39,7 +39,7 @@ jobs:
         run: make test
 
       - name: codecov coverage report
-        uses: codecov/codecov-action@aa56896cf108bd10b5eb883cd1d24196da57f695  # v5.5.4
+        uses: codecov/codecov-action@75cd11691c0faa626561e295848008c8a7dddffe  # v5.5.4
         with:
           files: ./coverage.out
 

.github/workflows/scorecard.yml

@@ -25,7 +25,7 @@ jobs:
           persist-credentials: false
 
       - name: Run analysis
-        uses: ossf/scorecard-action@99c09fe975337306107572b4fdf4db224cf8e2f2  # v2.4.3
+        uses: ossf/scorecard-action@4eaacf0543bb3f2c246792bd56e8cdeffafb205a  # v2.4.3
         with:
           results_file: results.sarif
           results_format: sarif