chore(ci): pin all 3rd party actions

[dreamorosi]

Description of your changes

As described in the linked issue, we want to apply a zero-trust policy on all 3rd party GitHub Actions by pinning their commit sha. This allows us to ensure that our workflow use only a version of the action that we know it's legitimate and we trust.

This PR introduces full commit hashes to all 3rd party GitHub Actions used in our workflows.

Related issues, RFCs

Issue number: #1440

Checklist

• My changes meet the tenets criteria
• I have performed a self-review of my own code
• I have commented my code where necessary, particularly in areas that should be flagged with a TODO, or hard-to-understand areas
• I have made corresponding changes to the documentation
• My changes generate no new warnings
• I have added tests that prove my change is effective and works
• The PR title follows the conventional commit semantics

Breaking change checklist

Is it a breaking change?: NO

• I have documented the migration process
• I have added, implemented necessary warnings (if it can live side by side)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.