This PR updates the GitHub Action workflows to use full length commit SHAs instead of mutable tags (e.g., @v2).
By pinning to a specific hash, we ensure that the code running in our CI/CD pipeline is exactly what we audited, protecting us from "tag shifting" where a version tag is moved to a different (potentially malicious) commit.

Using version tags like @V3 relies on trust that the maintainer’s account won't be compromised. If an attacker gains access to a dependency we use, they can push a malicious update to that tag, and our pipeline would automatically pull the compromised code.

Reference Incident: aquasecurity/trivy-action#541