Backport workflow-hardening fix (unpinned-uses) to 5 release branches

### Summary
The default branch already hardened `.github/workflows/build.yml` against the issue(s) below, but **5** release branches still carry it. This proposes the same, minimal, scanner-verified fix for each.

### What's flagged (by [zizmor](https://github.com/woodruffw/zizmor))
- `unpinned-uses` — actions referenced by mutable tag/branch instead of a pinned commit SHA

Already resolved on the default branch in:
- https://github.com/bottlerocket-os/bottlerocket/commit/410c561b61422167ee41db44a8a7c2d4dc95d2fd

### Affected release branches (5)
- **`1.23.x`** (still present as of HEAD `74970be4`)
- **`1.21.x`** (still present as of HEAD `82691b51`)
- **`1.18.x`** (still present as of HEAD `7452c37e`)
- **`1.19.x`** (still present as of HEAD `64049ba8`)
- **`1.20.x`** (still present as of HEAD `a3e8bda1`)

### Suggested per-branch patches
Each diff below was checked locally with **zizmor** and **actionlint**: the flagged finding(s) are cleared on the affected construct and no new lint or security findings are introduced. (Whitespace is normalized; only security-relevant lines change.)

1.23.x — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@
delay=$((1 + $RANDOM % 32))
echo "Waiting ${delay} seconds before execution"
sleep $delay
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Preflight step to set up the runner
uses: ./.github/actions/setup-node
- run: rustup component add rustfmt
```

1.21.x — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -56,7 +56,7 @@
delay=$((1 + $RANDOM % 32))
echo "Waiting ${delay} seconds before execution"
sleep $delay
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Preflight step to set up the runner
uses: ./.github/actions/setup-node
- run: rustup component add rustfmt
```

1.18.x — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
delay=$((1 + $RANDOM % 32))
echo "Waiting ${delay} seconds before execution"
sleep $delay
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Preflight step to set up the runner
uses: ./.github/actions/setup-node
- if: contains(matrix.variant, 'nvidia')
```

1.19.x — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
delay=$((1 + $RANDOM % 32))
echo "Waiting ${delay} seconds before execution"
sleep $delay
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Preflight step to set up the runner
uses: ./.github/actions/setup-node
- if: contains(matrix.variant, 'nvidia')
```

1.20.x — unpinned-uses

File `.github/workflows/build.yml`; suggested edits:
- ~ jobs.$J.steps[uses=actions/checkout].uses : pin(actions/checkout -> target_ref SHA)

```diff
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -58,7 +58,7 @@
delay=$((1 + $RANDOM % 32))
echo "Waiting ${delay} seconds before execution"
sleep $delay
- - uses: actions/checkout@v4
+ - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
- name: Preflight step to set up the runner
uses: ./.github/actions/setup-node
- if: contains(matrix.variant, 'nvidia')
```

---
*Happy to open pull requests instead if that's preferred.*

Update .github/workflows/build.yml on the 1.23.x, 1.21.x, 1.18.x, 1.19.x, and 1.20.x release branches, using the corresponding suggested changes in the issue. Run zizmor and actionlint for each branch; done means the unpinned-uses findings are cleared without introducing new lint or security findings.

Written by the indexing model from the issue text.