Pin GitHub actions to SHAs instead of versions

[westonruter]

See discussion with @thelovekesh at #1838 (comment):

My recommendation would be to pin it to a specific SHA for better security.
[...]
Also, in core, it's very rare for maintainers to allow third-party actions, and when they do, they always pin to a specific SHA to mitigate potential security risks.
[...]
By default, pin to the SHA of a version that was published at least a week ago. This provides ample time to detect if the action has been compromised.

Note that Gutenberg's workflows all have actions pinned to SHAs.

I used Gemini CLI to do this for me, using the prompt:

I want to update the GitHub actions in .github use SHA pinning instead of just referencing the version. I want the version to be in a comment after the sha

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 68.81%. Comparing base (440216b) to head (e707863).
⚠️ Report is 2 commits behind head on trunk.

Additional details and impacted files

@@           Coverage Diff           @@
##            trunk    #2171   +/-   ##
=======================================
  Coverage   68.81%   68.81%           
=======================================
  Files          90       90           
  Lines        8006     8006           
=======================================
  Hits         5509     5509           
  Misses       2497     2497           

Flag	Coverage Δ
multisite	68.81% <ø> (ø)
single	35.47% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[github-actions]

The following accounts have interacted with this PR and/or linked issues. I will continue to update these lists as activity occurs. You can also manually ask me to refresh this list by adding the props-bot label.

If you're merging code through a pull request on GitHub, copy and paste the following into the bottom of the merge commit message.

Co-authored-by: westonruter <[email protected]>
Co-authored-by: mukeshpanchal27 <[email protected]>

To understand the WordPress project's expectations around crediting contributors, please review the Contributor Attribution page in the Core Handbook.

[westonruter]

For this one, the tag is in fact v8 but the release name is v8.0.0: https://github.com/actions/github-script/releases/tag/v8