Lock GitHub Actions dependencies to SHAs for security and predictability

Lock GitHub Actions dependencies to SHAs for security and predictability

Locking to SHAs is best practice for security and predictability as we know exactly which version is being used. Without locking to SHAs, Actions will simply use whatever latest version is available for the given specified version, usually a major such as "v4", leading to "silent bumps" at the runtime level of sorts.

Locking to SHAs will also allow us to receive patch and minor level dependency upgrade PRs as opposed to, in most cases, just bumps for major versions.