ci: SHA-pin the pages + gitea actions like the other workflows

pages.yaml floated every action on major tags (checkout@v4,
configure-pages@v5, jekyll-build-pages@v1, upload-pages-artifact@v3,
deploy-pages@v4) and the Gitea build used checkout@v4, while qa.yaml
and both release workflows pin SHAs -- the repo's stated supply-chain
policy (dependabot.yml). Pin each to the newest release of the major it
already used (checkout gets the same v7.0.0 the other workflows pin),
so this is a no-op in behaviour. Dependabot keeps the pins current.
Verify on the next pages run: same ~60 s job, pinned refs in the log.

Assisted-by: AI

Author: AndrewDemsDS

.gitea/workflows/build.yaml

@@ -21,7 +21,7 @@ jobs:
   amebaz2-build:
     runs-on: sdk-builder   # host-mode Gitea runner: ~/ameba-dev + ARM toolchain on PATH
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Provision build env from the runner host
         run: |

.github/workflows/pages.yaml

@@ -41,20 +41,20 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Assemble the site
         run: |
           python3 .github/scripts/assemble_docs_site.py
 
-      - uses: actions/configure-pages@v5
+      - uses: actions/configure-pages@983d7736d9b0ae728b81ab479565c72886d7745b # v5.0.0
 
-      - uses: actions/jekyll-build-pages@v1
+      - uses: actions/jekyll-build-pages@44a6e6beabd48582f863aeeb6cb2151cc1716697 # v1.0.13
         with:
           source: ./_site_src
           destination: ./_site
 
-      - uses: actions/upload-pages-artifact@v3
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3.0.1
 
   deploy:
     needs: build
@@ -65,14 +65,14 @@ jobs:
       url: ${{ steps.deployment.outputs.page_url }}
     steps:
       - id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4.0.5
 
       # Tell IndexNow the site changed, instead of waiting to be crawled. Runs AFTER deploy so the
       # URLs (and the key file it verifies) are actually live. The key is not a secret: engines
       # authenticate by fetching it from the site, which is why it is committed rather than stored
       # as a repo secret. Never allowed to fail the workflow -- a submission endpoint being down
       # says nothing about whether the site published.
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
       - name: Ping IndexNow
         continue-on-error: true
         env: