ci: pin GitHub Actions to full-length commit SHAs (#4307)