chore(ci): AUT-1135 pin GitHub Actions to commit SHAs

[svcnemo-autobot]

Background

Tagged GitHub Action references are mutable.

What changed

• Pin external actions to equivalent full commit SHAs.
• Retain each source tag or branch in an inline comment.

Details

flowchart LR
    T[Tag or branch] --> C[Resolved commit]
    C --> W[Pinned workflow]

Loading

Updated references under .github.

Tested

• Parsed every changed YAML file.
• No new actionlint diagnostics versus upstream.
• git diff --check.

[github-actions]

This PR has been automatically converted to draft because all PRs must start as drafts.

When you are ready for review, click Ready for Review to begin the review process. This will:

1. Add the oncall reviewer (optional reviewer)
2. Add required review teams based on your changes

See the contribution guide for more details.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[svcnemo-autobot]

/ok to test 7ffe919