chore(ci): pin GitHub Actions to commit SHAs (#2277)