Pin 3rd-party actions to SHA1

[fbricon]

Hi!

Following the GH Action Security Hardening guide we should use the commit SHA instead of the branch or tag for any third-party untrusted action.

This PR was submitted by a script.

[codecov-commenter]

Codecov Report

Base: 67.46% // Head: 67.46% // No change to project coverage 👍

Coverage data is based on head (4e7fd6c) compared to base (9f8f207).
Patch has no changes to coverable lines.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #738   +/-   ##
=======================================
  Coverage   67.46%   67.46%           
=======================================
  Files         118      118           
  Lines        6866     6866           
  Branches     1208     1208           
=======================================
  Hits         4632     4632           
  Misses       2234     2234           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

☔ View full report at Codecov.
📢 Do you have feedback about the report comment? Let us know in this issue.

[rgrunber]

Change looks good to me. Feel free to merge.