Pin SHA hashes of all actions via gha-tools command

[maresb]

uvx gha-tools autoupdate ./.github/workflows/ --pin=all --version-strategy=specific --write

This is meant to satisfy zizmor as per the discussion in #1633.

This is considered a security best-practice. GitHub Actions is a huge supply-chain attack surface, and there are occasional compromises of Actions repositories. By pinning the SHA we create a clear record of which action version we're running, and also prevent random uncontrolled upgrades.

As for version upgrades, dependabot will take care of that, respecting the SHAs and version comments.

CC @Armavica

---

📚 Documentation preview 📚: https://pytensor--1656.org.readthedocs.build/en/1656/

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 81.56%. Comparing base (db5178b) to head (333cf99).
⚠️ Report is 4 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1656      +/-   ##
==========================================
- Coverage   81.56%   81.56%   -0.01%     
==========================================
  Files         242      242              
  Lines       53818    53819       +1     
  Branches     9485     9485              
==========================================
  Hits        43899    43899              
- Misses       7430     7431       +1     
  Partials     2489     2489              

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.