Update and pin all GHA actions (#777)

Author: mjameswh

.github/workflows/ci.yml

@@ -8,16 +8,16 @@ jobs:
     name: "Gradle wrapper validation"
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
-      - uses: gradle/actions/wrapper-validation@v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+      - uses: gradle/actions/wrapper-validation@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
 
   unittest:
     name: Unit Tests
     runs-on: ubuntu-latest
     timeout-minutes: 15
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
         submodules: recursive
@@ -33,20 +33,20 @@ jobs:
     timeout-minutes: 20
     steps:
     - name: Checkout repo
-      uses: actions/checkout@v4
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 0
         submodules: recursive
         ref: ${{ github.event.pull_request.head.sha }}
 
     - name: Set up Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
       with:
         java-version: "11"
         distribution: "temurin"
 
     - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@v3
+      uses: gradle/actions/setup-gradle@ac396bf1a80af16236baf54bd7330ae21dc6ece5 # v6
 
     - name: Run copyright and code format checks
       run: ./gradlew --no-daemon spotlessCheck