fix(ci): 3rd party Github Actions should be pinned

[aikido-autofix]

---

Description of the change

This patch mitigates a potential supply chain attack by pinning the version of third-party Github Actions to their commit SHA.

Checklist

Development

• The changes have been covered with tests, if necessary.
• You have a green build, with the exception of the flaky tests.
• UI and JS files are fully tested, the user interface works for all modules affected by your changes (e.g., solve and analyze buttons).
• The network calls work for all modules affected by your changes (e.g., solving a problem).
• The console messages are validated for all modules affected by your changes.

Code Review

• This pull request includes an explanatory title and description.
• The GitHub issue is linked.
• At least one other engineer has approved the changes.
• After PR is merged, inform the reporter.

---

Related Tasks & Ticket Links:

• https://github.com/TimefoldAI/ci/issues/148

AI Confidence Level: High confidence: Aikido has a robust set of benchmarks for similar fixes, and they are proven to be effective.