Improve CI supply chain security by pinning GitHub Actions to commit SHAs

**What steps did you take:**
Reviewed the GitHub Actions workflow configurations in the .github/workflows/ directory to audit supply-chain security hygiene.
Specifically, I checked for mutable action references using:
grep -rnE "uses:.*@(v[0-9]|main|master|latest)" .github/workflows/

**What happened:**
Currently, there are 38 call sites across 13 workflow files referencing third-party and reusable GitHub Actions using mutable tags (e.g., @v3.7.0, @v4, @main, @latest).

**What did you expect:**
To protect the repository from supply chain attacks, GitHub Actions should be pinned to immutable commit SHAs rather than mutable tags. If a third-party action's tag is force-moved or the upstream repository is compromised, the CI pipeline could execute malicious code.

This is particularly critical for workflows like release-process.yml, which operate with elevated permissions (id-token: write, packages: write, and contents: write).

**Anything else you would like to add:**
The recommended best practice is to resolve each mutable ref to its exact commit SHA, while appending the human-readable version as a comment.
For example:
Before: uses: actions/checkout@v4
After: uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4

Because dependabot.yml is already configured for the github-actions ecosystem in this repository, Dependabot will natively handle updating these SHAs and their version comments automatically going forward. There is zero additional maintenance burden for the team.

**Environment:**

- kapp Controller version (execute `kubectl get deployment -n kapp-controller kapp-controller -o yaml` and the annotation is `kbld.k14s.io/images`):
- Kubernetes version (use `kubectl version`)

---
Vote on this request

This is an invitation to the community to vote on issues, to help us prioritize our backlog. Use the "smiley face" up to the right of this comment to vote.

👍 "I would like to see this addressed as soon as possible"
👎 "There are other more important things to focus on right now"

We are also happy to receive and review Pull Requests if you want to help working on this issue.

Review the 13 workflow files under .github/workflows/ and use the issue's grep command to locate mutable action references. Resolve each reference to an immutable commit SHA while retaining its version comment, then verify the workflows contain no remaining mutable refs and confirm dependabot.yml covers the github-actions ecosystem.

Written by the indexing model from the issue text.