ci: pin third-party GitHub actions to immutable commit SHAs (OpenSSF Scorecard)

[emirhan-karaca]

Why this change is important

According to the OpenSSF Scorecard and SLSA Framework, referencing third-party GitHub Actions via mutable release tags (such as @v4 or @v5) introduces a supply-chain security vulnerability. If an upstream tag is maliciously moved or modified, arbitrary code can execute in your CI/CD environment.

What this PR does

• Pins all third-party GitHub Actions to immutable full 40-character commit hashes.
• Preserves the original human-readable version tags as inline comments for easy tracking:
  \\diff
  • uses: actions/checkout@v4
  • uses: actions/checkout@11d5960 # v4 [pinned by action-pin]
    \\
• Zero breaking changes to the build, test, or release pipelines.
• Preserves all existing YAML comments, spacing, and formatting.

Generated with action-pin.