security: AI Fix for 3rd party Github Actions should be pinned

[aikido-autofix]

This patch mitigates a potential supply chain attack by pinning the version of third-party Github Actions to their commit SHA.

Aikido used AI to generate this PR.

High confidence: Aikido has a robust set of benchmarks for similar fixes, and they are proven to be effective.

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}