[Security] GitHub Actions use unpinned action versions

## Description

Both CI workflow files (`official-build.yaml` and `pr-build.yaml`) reference GitHub Actions using mutable version tags (`@v3`) instead of pinned commit SHAs. This exposes the build pipeline to supply chain attacks — if a tag is moved to point to malicious code, the workflow would execute it automatically.

## Affected Files

- `.github/workflows/official-build.yaml` (lines 13, 16)
- `.github/workflows/pr-build.yaml` (lines 13, 16)

## Current (vulnerable)

```yaml
- uses: actions/checkout@v3
- uses: actions/setup-dotnet@v3
```

## Suggested Fix

Pin actions to full commit SHAs and add a comment with the version for readability:

```yaml
- uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
- uses: actions/setup-dotnet@4d6c8fcf3c8f7a60068d26b594648e99df24cee3 # v4.0.0
```

Also consider upgrading from v3 to v4 for both actions while pinning.

Alternatively, enable Dependabot for GitHub Actions to automate version updates:

```yaml
# .github/dependabot.yml
version: 2
updates:
- package-ecosystem: github-actions
directory: /
schedule:
interval: weekly
```

## Severity

**Medium** — Requires compromise of upstream action repository, but this is a documented attack vector (e.g., the `codecov/codecov-action` incident).

Start with the affected action references at lines 13 and 16 of .github/workflows/official-build.yaml and .github/workflows/pr-build.yaml. Replace the mutable tags with full commit SHAs, retaining version comments, and verify that both workflows use pinned actions; consider the issue's suggested v4 upgrade or the alternative Dependabot configuration.

Written by the indexing model from the issue text.