fix(ci): use commit SHA for pypa/gh-action-pypi-publish (not tag SHA)

Annotated tags resolve to tag objects, not commits. GitHub Actions
needs the underlying commit SHA to find the Docker image.

Author: eFAILution

.github/workflows/publish-pypi.yml

@@ -113,6 +113,6 @@ jobs:
           path: dist/
 
       - name: Publish to TestPyPI
-        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
         with:
           repository-url: https://test.pypi.org/legacy/

.github/workflows/publish-release.yml

@@ -49,7 +49,7 @@ jobs:
           argus scan --list
 
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
+        uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # v1.14.0
 
   publish-containers:
     name: Publish Container Images