Pin all GitHub Actions references (#4901)

This hash-pins all GitHub Actions.

I used `pinact run -v` to perform and verify this;
a separate tool like `gha-update` could be used to
cross-check them for honesty!

Note: This only pins the actions; I haven't attempted
any bumps. Dependabot will keep them updated, including
updating the version comments.

Signed-off-by: William Woodruff <william@yossarian.net>