ci: pin GitHub Actions to commit SHAs

[nkbranigan]

Pin GitHub Actions by SHA to implement security best practices.

• Behavior is not changed, with each action pinned to the same commit as currently.
• Security best practices recommend that all GitHub Actions be pinned by SHA rather than referred to by, for example, tags (GitHub, OSSF, OWASP). Not using SHAs can be exploited by attackers (for example GHSA-mrrh-fwg8-r2c3).
• I verified for each action that the SHA and tag pins are identical by running the following code:
  tag_sha_test.py