[CI] Pin remaining actions to sha

[jbampton]

We already pin here:

https://github.com/apache/whimsy/blob/master/.github/workflows/pre-commit.yml

ruby/setup-ruby@afeafc3

actions/setup-node@48b55a0

actions/checkout@df4cb1c

---

Using mutable tags like @v4 leaves your pipelines vulnerable to supply chain attacks if a developer's account is compromised. Pinning to a unique 40-character commit SHA ensures you run immutable, unalterable code that cannot be silently modified by bad actors. This practice guarantees absolute build reproducibility because cryptographic hashes cannot be force-pushed or rewritten. It also protects your workflows from risks like repository deletion or malicious name squatting. For maximum safety, pairs SHAs with inline comments so dependency tools can still automate your version updates.

[sebbASF]

Thanks!