Use commit SHA values for third-party actions.

[desrosj]

See GitHub hardening recommendations: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions.

[github-actions]

Here is a list of everyone that appears to have contributed to this PR and any linked issues:

# Committers
Co-authored-by: desrosj <[email protected]>

# Reviewers


# Commenters


# Reporters


# Unconnected

_{props-bot-action}