chore: add missed SHA pins (pinact silently no-op'd; using own resolver)

The original campaign run used pinact 4.0.0 which silently failed to pin
third-party refs in this PR (transient API issue, zero exit code, no diff).
This commit adds the missed pins using our own gh-api-backed resolver
(see gha-security-audit/pin_resolver.py + test_pin_resolver.py).

Tracking: DEVPROD-1072

Author: lastnode

.github/workflows/gradle-wrapper-validation.yml

@@ -7,4 +7,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v4
-      - uses: gradle/actions/wrapper-validation@v4
+      - uses: gradle/actions/wrapper-validation@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4

.github/workflows/submit-gradle-dependencies.yml

@@ -16,4 +16,4 @@ jobs:
           distribution: 'temurin'
           java-version: '17'
       - name: Setup Gradle to generate and submit dependency graphs
-        uses: gradle/actions/dependency-submission@v4
+        uses: gradle/actions/dependency-submission@48b5f213c81028ace310571dc5ec0fbbca0b2947 # v4