Hash-pin GitHub Actions

[pnacht]

Fixes #1102.

This PR ensures a workflow's behavior isn't disrupted whenever an Action publishes a broken or malicious release by hash-pinning all Actions.

The only exceptions are the cifuzz Actions, which unfortunately have to be kept @master due to how the project's infrastructure is set up.

[cowtowncoder]

Thanks! While I really dislike use of hashes for readability reasons, this is quite ok since:

1. There's comment on which version hash (allegedly :) ) matches, and
2. It's auto-updated by Dependabot (... does it add comment too? Too bad if not)
3. It's for action deps where version doesn't have much significance to me anyway ("just use the latest")

So I think I'll merge this as suggested. Thanks!

[pnacht]

2. It's auto-updated by Dependabot (... does it add comment too? Too bad if not)

Yes, Dependabot will also keep the version comment up-to-date.

[cowtowncoder]

2. It's auto-updated by Dependabot (... does it add comment too? Too bad if not)

Yes, Dependabot will also keep the version comment up-to-date.

Excellent. That's perfect then.

[cowtowncoder]

@pnacht I was wondering if you could provide PR to do the same for jackson-databind and jackson-annotations? I like how this has worked here.

[pnacht]

Done!