chore: pin third-party GitHub Actions to commit SHAs

[Dong Ma (larainema)]

Summary

Pin all third-party GitHub Actions to full commit SHAs instead of mutable version tags.

This prevents supply chain attacks where a compromised tag could silently inject malicious code into CI/CD pipelines (similar to the tj-actions/changed-files incident).

Changes

• Replace tag-based references (e.g., @v4) with full 40-character commit SHA pins
• Add version comments (e.g., # v4) for human readability

Why

• Immutability: Git tags can be force-pushed, but commit SHAs cannot be changed
• Supply chain security: Prevents tag hijacking attacks
• Auditability: Each pinned version is traceable to an exact commit