Pin GitHub Actions to full-length commit SHAs

[r7sy]

Pin all GitHub Actions in CI workflows to their full-length commit SHAs using pinact.

Changes

• actions/checkout@v4 → actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
• actions/setup-python@v5 → actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0

Rationale

GitHub Action tags are mutable — a tag like v4 can be force-pushed to point to a different commit at any time. Pinning to a full-length commit SHA ensures workflows use an immutable reference, mitigating the risk of a compromised or hijacked upstream action.

This is a GitHub-recommended security practice:

Pinning an action to a full length commit SHA is currently the only way to use an action as an immutable release.

Benefit

This change improves the project's OpenSSF Scorecard score on the Pinned-Dependencies check, which verifies that workflow dependencies are pinned to specific, immutable versions. The version tag is preserved as a comment (e.g., # v4.3.1) for readability and to support automated update tools like Renovate and Dependabot.