ci: use full-length commit sha for github owned actions

[Fdawgs]

Use full-length commit sha for github owned actions just to be on safe side, especially after https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/

[Copilot]

Pull request overview

Pins GitHub-owned GitHub Actions in the repo’s workflows to full-length commit SHAs (instead of version tags) to reduce supply-chain risk, while retaining the human-readable version in inline comments.

Changes:

• Update actions/checkout references to a full 40-char commit SHA (with # v6.0.2 comment).
• Update actions/setup-node references to a full 40-char commit SHA (with # v6.4.0 comment).
• Update github/codeql-action (init/analyze) references to a full 40-char commit SHA (with # v4.35.5 comment).

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/codeql.yml	Pins actions/checkout and github/codeql-action/* to full commit SHAs.
.github/workflows/ci.yml	Pins actions/checkout and actions/setup-node to full commit SHAs for CI runs.
.github/workflows/cd.yml	Pins actions/checkout and actions/setup-node to full commit SHAs for release/publish jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.