chore: pin docker workflows to ASF allowlist versions

[amoeba]

Fixes CI jobs that are currently failing due to errors like this one,

The actions docker/setup-buildx-action@v3, docker/login-action@v3, and docker/setup-qemu-action@v3 are not allowed in apache/arrow-nanoarrow because all actions must be from a repository owned by your enterprise, created by GitHub, or match one of the patterns

Updates references to workflows that need to be pinned to ASF allowlisted refs from https://github.com/apache/infrastructure-actions/blob/main/actions.yml. All other workflows are from actions/* so those should be fine (though outdated).

Closes #860

[amoeba]

The alpine-s390x verify job is failing on trying to install fs so I'm trying out 516421f.

[amoeba]

Ah, I see the image needs to get rebuilt, I'll make another PR to add libuv-dev to the dockerfile. This is ready for review.

[paleolimbot]

Thank you!

I forgot we have to merge this before we can rebuild the image on main (I tried: https://github.com/apache/arrow-nanoarrow/actions/runs/24015244616 ). I'll merge + manually trigger the build and then verify actions to check.