Pin all actions to commit SHA

This was recommended in https://discourse.canonical.com/t/guarding-against-the-guardians-hardening-github-in-the-wake-of-the-trivy-supply-chain-attack/7181. I enabled the repo setting "Require actions to be pinned to a full-length commit SHA" and started getting failures due to the reusable workflows I've been borrowing from here for https://github.com/canonical/registry-snap.