chore(security): uses pinned versions of actions

[jcchavezs]

[welcome[bot]]

Thanks for opening your first pull request! If you haven't yet signed our Contributor License Agreement (CLA), then please do so that we can accept your contribution. A link should appear shortly in this PR if you have not already signed one.

[brettmc]

Hi @jcchavezs can you give some info on what this is about? Has it come from a higher-level task to apply to all SIGs, or were we doing something wrong? Are we pinning so that dependabot doesn't update our actions?

[bobstrecansky]

just following up here @jcchavezs, thanks!