ci: pin create-pull-request to a sha, as pinact requires

Author: benjcooley

.github/workflows/update-corpus-pins.yaml

@@ -72,7 +72,7 @@ jobs:
           PY
 
       - name: Open the bump PR
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@22a9089034f40e5a961c8808d113e2c98fb63676 # v7.0.11
         with:
           branch: chore/corpus-pins
           commit-message: 'chore: bump ecosystem matrix corpus pins'