[Security] Pin GitHub Actions dependency SHAs

Requested in a conversation from Discord: https://discord.com/channels/368267295601983490/701922522836369498/1504121096608415888

https://github.blog/security/supply-chain-security/securing-the-open-source-supply-chain-across-github/
https://github.blog/news-insights/product-news/whats-coming-to-our-github-actions-2026-security-roadmap/

**Implementation**
* https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions

**Acceptance criteria**

`Require actions to be pinned to a full-length commit SHA` should be enabled for:
* [x] repo: `Anki-Android`https://github.com/ankidroid/Anki-Android/pull/21039
* [ ] repo: `Anki-Android-Backend`
* [ ] repo: `ankidroiddocs`
* [ ] org: `ankidroid` (& all sub-repos)

https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/