Pin all GitHub Actions references

[woodruffw]

Description

This hash-pins all GitHub Actions.

I used pinact run -v to perform and verify this; a separate tool like gha-update could be used to cross-check them for honesty!

Note: This only pins the actions; I haven't attempted any bumps. Dependabot will keep them updated, including updating the version comments.

For context: this is an important (but not final) step towards making GitHub Actions runs generally more hermetic/reproducible. One of the big issues with GitHub Actions is that it encourages mutable tag usage by default, meaning that an attacker who manages to take over a third-party action can pretty easily pivot onto lots of critical project by force-pushing over an existing version tag. Hash-pinning prevents that.

For more information, I've put some docs on hash pinning in zizmor's audit docs: https://docs.zizmor.sh/audits/#unpinned-uses

Checklist - did you ...

• Implement any code style changes under the --preview style, following the
  stability policy?
• Add an entry in CHANGES.md if necessary?
• Add / update tests if necessary?
• Add new / update outdated documentation?

Leaving all of the above blank since I believe this is an internal-only CI change 🙂

[github-actions]

diff-shades reports zero changes comparing this PR (55f06d6) to main (782e560).

---

What is this? | Workflow run | diff-shades documentation

[woodruffw]

xref #4611 for some backing motivation here -- I'll do some more follow-up PRs for other findings from zizmor 🙂