Pin dependencies: not just list version but specify commit hash

[cherriechang]

Tracking issue for:

• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/13
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/12
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/11
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/10
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/9
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/8
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/7
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/6
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/5
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/4
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/3
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/2
• [ ] https://github.com/jspsych/jsPsych/security/code-scanning/1

Instructions Code Documentation

Basically pin dependencies involved in each GitHub Action workflow