[ci] Pins github action commit hash

[chunhtai]

as title. This is required due to our policy

context: https://github.com/flutter/flutter/issues/179033

Pre-Review Checklist

• [ ] I read the Contributor Guide and followed the process outlined there for submitting PRs.
• [ ] I read the Tree Hygiene page, which explains my responsibilities.
• [ ] I read and followed the relevant style guides and ran the auto-formatter.
• [ ] I signed the CLA.
• [ ] The title of the PR starts with the name of the package surrounded by square brackets, e.g. [shared_preferences]
• [ ] I linked to at least one issue that this PR fixes in the description above.
• [ ] I updated pubspec.yaml with an appropriate new version according to the pub versioning philosophy, or I have commented below to indicate which version change exemption this PR falls under[^1].
• [ ] I updated CHANGELOG.md to add a description of the change, following repository CHANGELOG style, or I have commented below to indicate which CHANGELOG exemption this PR falls under[^1].
• [ ] I updated/added any relevant documentation (doc comments with ///).
• [ ] I added new tests to check the change I am making, or I have commented below to indicate which test exemption this PR falls under[^1].
• [ ] All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.

Note: The Flutter team is currently trialing the use of Gemini Code Assist for GitHub. Comments from the gemini-code-assist bot should not be taken as authoritative feedback from the Flutter team. If you find its comments useful you can update your code accordingly, but if you are unsure or disagree with the feedback, please feel free to wait for a Flutter team member's review for guidance on which automated comments should be addressed.

[^1]: Regular contributors who have demonstrated familiarity with the repository guidelines only need to comment if the PR is not auto-exempted by repo tooling.