Docker and mutation workflow actions should be pinned by commit SHA

[Widthdom]

Problem

Most workflow actions are pinned by SHA, but several release/mutation actions still use mutable tags.

Evidence

• .github/workflows/release.yml uses docker/setup-buildx-action@v3, docker/login-action@v3, docker/build-push-action@v6, and actions/checkout@v6 in publish paths.
• .github/workflows/mutation-testing.yml uses actions/checkout@v6 and actions/setup-dotnet@v5.

Expected behavior

Pin these actions to reviewed commit SHAs, matching the policy used by the rest of the workflows.

Labels

security, dependencies, github_actions

[Widthdom]

Work started on branch fix-issue3485-3486-3487-3489-3490-3491-3508.