Automate pinning CI dependencies to specific commit hashes

[dconnolly]

Motivation

It'd be nice to be able to manage our CI actions and other dependencies like we do with our cargo etc deps.

The newish https://github.com/sethvargo/ratchet may help us do that.