ci: pin third-party actions to full commit SHAs (matching the existing setup-uv pin)

Author: kobihikri

.github/workflows/codspeed.yml

@@ -26,7 +26,7 @@ jobs:
         run: make build
 
       - name: Run benchmarks
-        uses: CodSpeedHQ/action@v3
+        uses: CodSpeedHQ/action@76578c2a7ddd928664caa737f0e962e3085d4e7c # v3.8.1
         with:
           token: ${{ secrets.CODSPEED_TOKEN }}
           run: uv run --frozen pytest tests/benchmarks --codspeed

.github/workflows/gh-pages-release.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Build docs
         run: make docs
       - name: Deploy release docs
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           personal_token: ${{ secrets.PERSONAL_TOKEN }}
           publish_dir: build/html

.github/workflows/gh-pages.yml

@@ -16,7 +16,7 @@ jobs:
       - name: Build docs
         run: make docs
       - name: Deploy latest docs
-        uses: peaceiris/actions-gh-pages@v3
+        uses: peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
         with:
           personal_token: ${{ secrets.PERSONAL_TOKEN }}
           publish_dir: build/html

.github/workflows/pypi.yml

@@ -15,7 +15,7 @@ jobs:
       - name: Build dists
         run: make build
       - name: Pypi Publish
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@6733eb7d741f0b11ec6a39b58540dab7590f9b7d # v1.14.0
         with:
           user: __token__
           password: ${{ secrets.pypi_password }}