ci: pin GitHub Actions to full commit SHAs (#1646)