CI: pin actions by SHA

This eliminates the possibility of a tag being changed under
us.

Author: tacaswell

.github/workflows/check-test-coverage.yml

@@ -23,7 +23,7 @@ jobs:
         export MPL_IMGCOMP_TOLERANCE=20
         coverage run -m pytest --mpl --doctest-glob="probscale/*.py" --cov-report=xml
     - name: Upload coverage to Codecov
-      uses: codecov/codecov-action@v1
+      uses: codecov/codecov-action@29386c70ef20e286228c72b668a06fd0e8399192 # v1
       with:
         # directory: ./coverage/reports/
         flags: unittests