Pin third-party actions to commit SHAs

Sounds like best practice is not to simply pin to a version to get the latest patch updates, but to pin to a specific commit SHA.

For all calls to third-party actions, pin to a specific SHA, copied directly from the action source.

Kaleb: Set up a periodic review of SHAs or ensure that security alerts will issue for specific SHAs.

Search the repository's GitHub Actions workflow files for every third-party action reference and verify each uses a commit SHA copied from the action source. Done means all such calls are SHA-pinned; clarify whether the requested periodic SHA review or security-alert setup is part of this change.

Written by the indexing model from the issue text.