chore(ci): lockdown 3rd party workflows to pin sha

[heitorlessa]

Issue number: #1009

Summary

Changes

Please provide a summary of what's being changed

This PR increases our security posture following an older malicious token leak from codecov workflow (addressed last year). This guarantees that any change to GitHub Actions workflows that include or update 3rd party actions use pin to their respective git sha, thus making it an immutable use.

Official docs: https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

User experience

Please share what the user experience looks like before and after this change

As a maintainer, we should see the following error when non-compliant:

Checklist

If your change doesn't seem to apply, please leave them unchecked.

• Meet tenets criteria
• I have performed a self-review of my this change
• Changes are tested
• Changes are documented
• PR title follows conventional commit semantics

Is this a breaking change?

RFC issue number:

Checklist:

• Migration process documented
• Implement warnings (if it can live side by side)

Acknowledgment

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

Disclaimer: We value your time and bandwidth. As such, any pull requests created on non-triaged issues might not be successful.