ci: pin get-vault-secrets action to SHA

Pin grafana/shared-workflows/actions/get-vault-secrets to a full commit
SHA instead of a mutable version tag to prevent supply chain attacks.

Author: zalegrala

.github/workflows/publish-and-deploy-images.yaml

@@ -99,7 +99,7 @@ jobs:
                     max-parallelism = 2
 
             - name: Retrieve credentials from Vault
-              uses: grafana/shared-workflows/actions/get-vault-secrets@get-vault-secrets/v1.2.1
+              uses: grafana/shared-workflows/actions/get-vault-secrets@9f37f656e063f0ad0b0bfc38d49894b57d363936 # get-vault-secrets/v1.2.1
               with:
                 common_secrets: |
                   DOCKERHUB_USERNAME=dockerhub:username