fix: pin 5 unpinned action(s)

[dagecko]

Re-submission of #4596. Had a problem with my fork and had to delete it, which closed the original PR. Apologies for the noise.

Summary

This PR pins all GitHub Actions to immutable commit SHAs instead of mutable version tags.

• Pin 5 unpinned actions to full 40-character SHAs
• Add version comments for readability

How to verify

Review the diff, each change is mechanical and preserves workflow behavior:

• SHA pinning: action@v3 becomes action@abc123 # v3, original version preserved as comment
• No workflow logic, triggers, or permissions are modified

I've been researching CI/CD supply chain attack vectors and submitting fixes to affected repos. Based on that research I built a scanner called Runner Guard and open sourced it here so you can scan yourself if you want to. I'll be posting more advisories over the next few weeks on Twitter if you want to stay in the loop.

If you have any questions, reach out. I'll be monitoring comms.

- Chris (dagecko)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 98.43%. Comparing base (3dc1cd6) to head (9d8afe4).
⚠️ Report is 275 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #4604      +/-   ##
==========================================
- Coverage   99.21%   98.43%   -0.78%     
==========================================
  Files          42       48       +6     
  Lines        3182     3138      -44     
==========================================
- Hits         3157     3089      -68     
- Misses         17       40      +23     
- Partials        8        9       +1     

Flag	Coverage Δ
	?
--ldflags="-checklinkname=0" -tags sonic	98.42% <ø> (?)
-tags go_json	98.29% <ø> (?)
-tags nomsgpack	98.35% <ø> (?)
go-1.18	?
go-1.19	?
go-1.20	?
go-1.21	?
go-1.25	98.37% <ø> (?)
go-1.26	98.43% <ø> (?)
macos-latest	98.37% <ø> (-0.84%)	⬇️
ubuntu-latest	98.43% <ø> (-0.78%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.