Ensure workflow reliability by hash-pinning GitHub Actions

[pnacht]

When developing CI workflows, it's common to version-pin dependencies (i.e. actions/checkout@v4). But version tags are mutable, so a malicious attacker could overwrite a version tag to point to a malicious or vulnerable commit instead.

Pinning workflow dependencies by hash ensures the dependency is immutable and its behavior is guaranteed.

These hashes can be automatically updated by dependabot. Whenever new versions Actions are released, you'll receive a single PR updating all of their hashes and version comments at once (see this example).

I'll send a PR pinning the Actions and setting up dependabot along with this issue.

[pnacht]

Closing this after the discussion in #877.