ci: pin graalvm/setup-graalvm to full commit SHA (COMP-1573)

The repo/org policy requires all GitHub Actions to be pinned to a full-length
commit SHA. Pin graalvm/setup-graalvm@v1 -> @cabbb10818fabc989d6dbd508e4846596d20dd2d
(v1.6.0) in build.yml (both native-image steps) and the dependency-graph workflow,
matching the SHA-pinning convention already used for the other actions.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: cristianrcv

.github/workflows/build.yml

@@ -37,15 +37,15 @@ jobs:
 
       - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: graalvm/setup-graalvm@v1
+      - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ matrix.musl }}
         with:
           java-version: '21'
           github-token: ${{ secrets.GITHUB_TOKEN }}
           native-image-job-reports: 'true'
           native-image-musl: 'true'
 
-      - uses: graalvm/setup-graalvm@v1
+      - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
         if: ${{ !matrix.musl }}
         with:
           java-version: '21'

.github/workflows/security-submit-dependecy-graph.yml

@@ -11,7 +11,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
-    - uses: graalvm/setup-graalvm@v1
+    - uses: graalvm/setup-graalvm@cabbb10818fabc989d6dbd508e4846596d20dd2d # v1.6.0
       with:
         java-version: 21