chore: pin GitHub Actions to full commit SHAs

[oli-sanders]

Summary

• Pins all GitHub Actions to immutable commit SHAs instead of mutable tags
• Prevents supply chain attacks where a compromised tag could inject malicious code
• Dependabot will keep pinned SHAs up to date automatically

Test plan

• Verify CI passes with pinned actions