GitHub actions need to be pinned to a SHA1

[Stebalien]

https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions#using-third-party-actions

[mikeal]

We should do this for all the Actions we pull from third parties. But for the actions we maintain we should use master or a release branch because managing the updates across so many repos will be too painful.

[laurentsenta]

(triage session) We want to come up with a way to track where this rule is implemented or violated.