Pin GH Actions to SHAs?

@Rick-Anderson @tdykstra @wadepickett (cc: @adegeo) ... In the Blazor samples repo, I pinned GH Actions to their SHAs and currently plan to update them annually, which I'm going to discuss with DR and Larry offline shortly. Just wanted to make sure that you saw https://github.com/dotnet/aspnetcore/pull/60948. My PR is at https://github.com/dotnet/blazor-samples/pull/492. If you want to proceed with similar steps here, this issue can serve to track it (and I'll take care of the two Blazor Actions). If not, please close this.