security: use commit hashes for GitHub Actions instead of version tags

security: use commit hashes for GitHub Actions instead of version tags #1616