Pin GitHub Actions to commit SHAs, drop unmaintained coverage comment

OSSF Scorecard's pinned-dependencies check was at 1/10. Out of 14
GitHub-owned action references only 3 were SHA-pinned (all in
scorecard.yml from PR #138); the rest were on floating tags like @v4
or, in one third-party case, on a branch ref (@main). Floating refs
are mutable; supply-chain attacks on actions become silent on push.

Pinning every reference to a full-length commit SHA with the human-
readable version as a trailing comment. Dependabot already runs on the
github-actions ecosystem (added earlier in this PR) so the version
comments stay fresh as bumps land.

Workflow-by-workflow:
- bandit.yml: pin actions/checkout v6.0.2, PyCQA/bandit-action v1.0.1
- codeql.yml: pin actions/checkout v6.0.2 and all three
  github/codeql-action sub-paths (init, autobuild, analyze) to v4.35.3
- publish.yml: pin actions/checkout v6.0.2, actions/setup-python v6.2.0,
  actions/upload-artifact v4.6.2, actions/download-artifact v4.3.0,
  and pypa/gh-action-pypi-publish v1.14.0 (was @release/v1 branch)
- python.yml: pin actions/checkout v6.0.2, actions/setup-python v6.2.0;
  drop MishaKav/pytest-coverage-comment@main step entirely. It was the
  only third-party action on a moving branch ref and the only reason
  the build job needed pull-requests: write. Coverage still gets
  printed to the workflow log via pytest --cov-report term-missing.

The pip-install commands in these workflows are still unpinned. That's
a follow-up PR -- requires generating a hash-pinned requirements.txt
with pip-tools and reworking the install steps.

Author: timlnx

.github/workflows/bandit.yml

@@ -21,9 +21,9 @@ jobs:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
       - name: Checkout code
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Perform Bandit Analysis
-        uses: PyCQA/bandit-action@v1
+        uses: PyCQA/bandit-action@ca64e96d362b1764a98d841aaf3a4b1e2d690c7b # v1.0.1
         with:
           targets: "bitmath/ tests/"

.github/workflows/codeql.yml

@@ -23,17 +23,17 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@v4
+        uses: github/codeql-action/init@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           languages: python
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@v4
+        uses: github/codeql-action/autobuild@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@v4
+        uses: github/codeql-action/analyze@e46ed2cbd01164d986452f91f178727624ae40d7 # v4.35.3
         with:
           category: "/language:python"

.github/workflows/publish.yml

@@ -12,14 +12,14 @@ jobs:
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     steps:
-      - uses: actions/checkout@v6.0.2
-      - uses: actions/setup-python@v6.2.0
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12"
       - name: Build package
         run: pip install build && python -m build
       - name: Upload dist artifacts
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
         with:
           name: dist
           path: dist/
@@ -32,9 +32,9 @@ jobs:
       id-token: write
     steps:
       - name: Download dist artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@d3f86a106a0bac45b974a628896c90dbdf5c8093 # v4.3.0
         with:
           name: dist
           path: dist/
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0

.github/workflows/python.yml

@@ -6,8 +6,6 @@ permissions: read-all
 
 jobs:
   build:
-    permissions:
-      pull-requests: write
     env:
       FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
     strategy:
@@ -17,10 +15,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: "GitHub Checks it out :sunglasses-face:"
-        uses: actions/checkout@v6.0.2
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Python ${{ matrix.python-version }}
-        uses: actions/setup-python@v6.2.0
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: ${{ matrix.python-version }}
           cache: 'pip'
@@ -47,10 +45,3 @@ jobs:
       - name: Run Unit Tests
         run: |
           pytest -v --cov=bitmath --cov-report term-missing --cov-report term:skip-covered --cov-report xml:coverage.xml tests
-
-      - name: Coverage report on PR
-        if: github.event_name == 'pull_request' && matrix.os == 'ubuntu-latest' && matrix.python-version == '3.12'
-        uses: MishaKav/pytest-coverage-comment@main
-        with:
-          pytest-xml-coverage-path: ./coverage.xml
-          title: "Test Coverage Report"