Pin actions to specific commits

This was something I saw a few other repos do a while ago, and yeah its a paranoia thing, but supply chain attacks keep happening left and right and its a trivial chage.

(also do the same to CI on other repos in org)