ci: pin github actions to pull commit SHAs

[dzeveloper]

This PR updates the GitHub Action workflows to use full length commit SHAs instead of mutable tags (e.g., @v2).
By pinning to a specific hash, we ensure that the code running in our CI/CD pipeline is exactly what we audited, protecting us from "tag shifting" where a version tag is moved to a different (potentially malicious) commit.

Using version tags like @V3 relies on trust that the maintainer’s account won't be compromised. If an attacker gains access to a dependency we use, they can push a malicious update to that tag, and our pipeline would automatically pull the compromised code.

Reference Incident: aquasecurity/trivy-action#541

[github-actions]

✅ All contributors have signed the CLA
_{Posted by the CLA Assistant Lite bot.}

[dzeveloper]

I have read the CLA Document and I hereby sign the CLA