Pin actions/github-script to commit SHA in first-time-contributor workflow

[harshitghagre]

What this PR does:

Pins actions/github-script from the mutable tag @v7 to its commit SHA
f28e40c7f34bde8b3046d885e986cb6290c5673b in the first-time-contributor.yaml
workflow. This follows the same convention used by other actions in this repo.

Why we need it:

The workflow currently fails for every first-time contributor because
actions/github-script@v7 is not in the repository's allowed GitHub Actions list.
Pinning to a commit SHA is a prerequisite for adding it to the allowed list, and
also improves security by preventing supply-chain attacks via mutable tags.

Which issue(s) this PR fixes:

Fixes #6726

Does this PR introduce a user-facing change?:

• How are users affected by this change: The "First-time contributor welcome"
  bot will start working again for new contributors once the SHA is added to the
  allowed list.
• Is this breaking change: No
• How to migrate (if breaking change): N/A

[eeshaanSA]

Hey @harshitghagre, have you verified this SHA?

[harshitghagre]

Hey @harshitghagre, have you verified this SHA?

Yes @eeshaanSA , I verified it.

[Ayushmore1214]

@harshitghagre looks good to me can we check it running once locally, if it works or fails ?

[Ayushmore1214]

@harshitghagre Plz get assigned to the issue first before opening a PR, discuss your idea or suggestion in the issue thread so other people can also learn for it as at last open source is all about learning, let it be for now as you are new contributor here but mind it next time, keep going you are doing good!!!

[harshitghagre]

Thanks @Ayushmore1214 for the heads up! I'll make sure to get assigned on the issue first and discuss my approach before opening PRs going forward. Appreciate the guidance 🙏

[harshitghagre]

@harshitghagre looks good to me can we check it running once locally, if it works or fails ?

@Ayushmore1214 I can’t test this locally because it needs the GitHub environment. I checked the SHA using git ls-remote. I didn’t change the logic just replaced the tag with its commit SHA.