[gha][toolchain-size] Pin external GitHub actions to specific commits

[kendalharland]

This prevents potentially breaking changes upstream from automatically rolling into our workflows, and ensures that builds are reproducible.

Changes

Pin these actions

• compnerd/gha-setup-swift
• compnerd/gha-setup-vsdevenv
• thebrowsercompany/gha-google-bloaty

[kendalharland]

Could you please add branch names as comments to help identify what they are without having to resolve the revisions using git rev-parse?

Done

[compnerd]

It might make sense to pin to a specific release as we are pinning to a version.

[kendalharland]

It might make sense to pin to a specific release as we are pinning to a version.

😭 We should probably come up with a cross-repo standard for BCNY and write it down somewhere.