Pin GHA dependencies by hash

[williamjallen]

Hash-pinned dependencies are an important requirement enforced by the OpenSSF scorecard tool: https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies

This commit pins all GitHub Actions workflows to a commit hash.

[wkliao]

Thanks. Could you please let me know how to obtain the GitHub action SHA,
so I can update it when a newer version is required in the future ?

[williamjallen]

@wkliao I'd recommend using Dependabot to automatically create dependency update PRs for GitHub Actions. Dependabot can update the hash and comment.

Usage of a dependency-update tool is another of the OpenSSF scorecard metrics. Kitware has funding to help PESO member projects improve security by implementing the OpenSSF scorecard recommendations. If you're interested, I'd be happy to make a follow-up PR to add a Dependabot config to create update PRs for these actions automatically.