Change third party github actions to target specific commits rather than tags

We should pin our third party github actions to a specific commit, rather than a tag as we currently do.

This is a cybersecurity measure recommended by GitHub:

The individual jobs in a workflow can interact with (and compromise) other jobs. For example, a job querying the environment variables used by a later job, writing files to a shared directory that a later job processes, or even more directly by interacting with the Docker socket and inspecting other running containers and executing commands in them.

This means that a compromise of a single action within a workflow can be very significant, as that compromised action would have access to all secrets configured on your repository, and may be able to use the GITHUB_TOKEN to write to the repository. Consequently, there is significant risk in sourcing actions from third-party repositories on GitHub. For information on some of the steps an attacker could take, see Secure use reference.

In our workflows, we have some third party actions used like such:

    - name: Install uv
      uses: astral-sh/setup-uv@v7

首先在仓库的工作流文件中搜索第三方 GitHub Actions，包括 astral-sh/setup-uv@v7 示例。将每个第三方 action 固定到特定 commit，而不是 tag，然后运行可用的工作流检查，以确认它们仍然通过。