Use commit hashes for GitHub Action versions

[bestbeforetoday]

Closes #387

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[denyeart]

I had been holding out on using commit hashes for github actions as I didn't know if the benefits warranted the additional maintenance, at least for github provided actions where the risk is low. For third party actions I agree there is more risk and therefore more reason to do so.

We could also decide to do it for release actions but not other actions since the stakes are higher for release actions.

This is probably a decision that should span all repositories, so just wanted to pause a moment and collect thoughts before merging.

[bestbeforetoday]

My intention was to also enable dependabot for the GitHub Actions ecosystem, which means that dependabot deals with keeping the hashes up-to-date with the latest release and it is no effort (other than merging dependabot PRs) for maintainers. I am already doing this successfully for the fabric-gateway repository.

[denyeart]

Ok sounds good.