Use commit SHA for ALL github actions, except the ones provided by Github (actions/*)

[pragmaticivan]

Is your feature request related to a problem? Please describe.
For security reasons and to avoid situations like the ones in tj-actions, I would recommend we use commit SHA for most actions. Dependabot supports tag updates as a comment already and there should be no major issues on that support.

[tylerbenson]

I'm not familiar... what happened to them?

[pragmaticivan]

I'm not familiar... what happened to them?

https://www.wiz.io/blog/github-action-tj-actions-changed-files-supply-chain-attack-cve-2025-30066 @tylerbenson

[tylerbenson]

Thanks. We can also point out that this is the recommended practice by Github.