Pin PyPI publish action for trusted publishing (#21730)

Author: justusschock

.github/workflows/release-pkg.yml

@@ -153,7 +153,8 @@ jobs:
           python -c "print('pkg=' + '${{ matrix.name }}'.lower())" >> $GITHUB_OUTPUT
 
       - name: Publish distribution 📦 to PyPI
-        uses: pypa/gh-action-pypi-publish@v1.5.1
+        # pypa/gh-action-pypi-publish v1.13.0
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e
         with:
           packages_dir: dist/${{ steps.folder.outputs.pkg }}
           verbose: true