Pin custom Github Actions to commit SHAs

[Eraz1997]

Summary

This PR pins references to custom Github Actions to commit SHAs instead of tags. This provides better security against supply-chain attacks and compliance with some customers' organisation settings.

Issues

• Action pinning #37.

Changes

• Replace references to tags of custom Github Actions with commit SHAs inside the custom action, used by customers
• Replace references inside this repo's CI jobs themselves

Benefits

• Pinning to commit SHAs provides better security against supply-chain attacks, in case a malicious actor manages to inject unauthorised changes and make tags point to them, since Github tags are mutable
  • This is a best practice recommended by Github itself (ref)
  • Example of recent widespread attack
• Some customers might be enforcing these organisation rules for compliance and security purposes. This Claude action currently doesn't comply with them, and thus is unusable.

This is a refactoring change with no functional impact on the action's behavior.

[Eraz1997]

cc @petery-ant @ashwin-ant for a review 🙏

[elgordomac]

@petery-ant @ashwin-ant would be great to get this merged, we're having to disable claude-code-security-review until its dependencies are pinned