ci: pin getsentry/craft refs in privileged workflows

Author: cursoragent

.github/workflows/changelog-preview.yml

@@ -15,5 +15,5 @@ permissions:
 
 jobs:
   changelog-preview:
-    uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2
+    uses: getsentry/craft/.github/workflows/changelog-preview.yml@f4889d04564e47311038ecb6b910fef6b6cf1363 # 2.25.0
     secrets: inherit

.github/workflows/release.yml

@@ -33,7 +33,7 @@ jobs:
           fetch-depth: 0
       - name: Prepare release
         id: prepare-release
-        uses: getsentry/craft@v2
+        uses: getsentry/craft@f4889d04564e47311038ecb6b910fef6b6cf1363 # 2.25.0
         env:
           GITHUB_TOKEN: ${{ steps.token.outputs.token }}
         with: