chore: pin GitHub Actions to SHA hashes for security (#25)

Pinned by pinact v3.10.0

Author: mg0x7BE

.github/workflows/dotnet.yml

@@ -15,10 +15,10 @@ jobs:
     runs-on: windows-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: 10.0.x
 
@@ -27,7 +27,7 @@ jobs:
           dotnet publish --runtime win-x64 -c Release -o "output/win-x64"
 
       - name: Upload Windows Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: win-x64-artifact
           path: output/win-x64/koji-stream-player.exe
@@ -37,10 +37,10 @@ jobs:
     runs-on: macos-latest
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Setup .NET
-        uses: actions/setup-dotnet@v5
+        uses: actions/setup-dotnet@c2fa09f4bde5ebb9d1777cf28262a3eb3db3ced7 # v5.2.0
         with:
           dotnet-version: 10.0.x
 
@@ -53,7 +53,7 @@ jobs:
           codesign --deep --force --verify --sign - output/osx-arm64/koji-stream-player
 
       - name: Upload macOS Artifact
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: osx-arm64-artifact
           path: output/osx-arm64/koji-stream-player
@@ -65,19 +65,19 @@ jobs:
     needs: [build-windows, build-macos]
     steps:
       - name: Download Windows Artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: win-x64-artifact
           path: output/win-x64/
 
       - name: Download macOS Artifact
-        uses: actions/download-artifact@v8
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
         with:
           name: osx-arm64-artifact
           path: output/osx-arm64/
 
       - name: Create GitHub Release and Upload Artifacts
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@b4309332981a82ec1c5618f44dd2e27cc8bfbfda # v3.0.0
         with:
           tag_name: "latest-${{ github.sha }}"
           name: "Auto-release"