CI: pin third-party GitHub Actions to specific commit SHAs for security

[RishavTiwari25]

This Pull Request fixes/closes #5142 .

It changes the following:

• Refactors all .github/workflows/*.yml files to use explicit, immutable 40-character commit SHAs instead of mutable tags (like @v6 or @stable) for third-party GitHub actions.
• Hardens the CI/CD pipeline against supply-chain and tag-hijacking attacks, complying with OpenSSF and GitHub advanced security best practices.
• Retains the original action version tags inline as # comments so developers can still easily read and identify action versions at a glance.
• Relies on the repository's existing dependabot.yml configuration to automatically keep these pinned SHAs updated going forward securely.

[github-actions]

Test262 conformance changes

Test result	main count	PR count	difference
Total	52,963	52,963	0
Passed	50,073	50,073	0
Ignored	2,072	2,072	0
Failed	818	818	0
Panics	0	0	0
Conformance	94.54%	94.54%	0.00%

Tested main commit: 50f0103d9188d33862efbc38397a81e497973632
Tested PR commit: ed75a518ecaf689eef2bdc27f1de2e6622376830
Compare commits: 50f0103...ed75a51

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 59.43%. Comparing base (6ddc2b4) to head (ed75a51).
⚠️ Report is 890 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5143       +/-   ##
===========================================
+ Coverage   47.24%   59.43%   +12.19%     
===========================================
  Files         476      580      +104     
  Lines       46892    63181    +16289     
===========================================
+ Hits        22154    37554    +15400     
- Misses      24738    25627      +889     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.