Pin GitHub Actions to commit hashes instead of version tags

[Aryex]

Summary

Several workflows reference third-party (and first-party) GitHub Actions by mutable version tag (e.g. actions/checkout@v4) instead of an immutable commit hash. A tag can be repointed by anyone who gains control of the action's repo, allowing a supply-chain attack to silently swap in malicious code without changing the pinned reference in our workflows.

Some actions in the repo are already pinned correctly, e.g.:

uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # stable
uses: arduino/setup-protoc@c65c819552d16ad3c9b72d9dfd5ba5237b9c906b # v3

Affected workflows

• .github/workflows/check-node-examples.yml — actions/checkout@v4 (x2)
• .github/workflows/check-csharp-examples.yml — actions/checkout@v4 (x2), actions/setup-dotnet@v4, actions/setup-python@v5
• .github/workflows/ci-cd.yml — actions/checkout@v4 (multiple), actions/setup-node@v4
• .github/workflows/static-checks.yml — actions/checkout@v4, actions/setup-node@v4

Proposed fix

Replace each uses: <action>@<tag> with uses: <action>@<commit-sha> # <tag>, resolving the SHA that the tag currently points to. This can likely be automated with a tool like Renovate (with pinDigests: true) or Dependabot so future updates keep the pin current automatically.

Raised from review discussion on #253.