Pin down GHA to SHA references to prevent compromise

[yfyf]

Same as dividat/playos#339

Btw, discovered a nice tool for automating this (after doing nearly all of it by hand...): https://github.com/sethvargo/ratchet

[knuton]

Thanks

In the meantime, cachix/install-nix-action@v31 resolves to a newer commit:

bash resolve-gh-ref.bash cachix/install-nix-action@v31
Fetching commit info for cachix/install-nix-action at v31...
--------------------------------------------------
Author:  sander <hey@sandydoo.me>
Date:    2026-04-13T10:46:50Z
URL:     https://github.com/cachix/install-nix-action/commit/ab739621df7a23f52766f9ccc97f38da6b7af14f
--------------------------------------------------
Merge pull request #274 from cachix/create-pull-request/patch

That seems fine.