chore(ci): pin all external actions to commit SHAs (PLATL-406)

[nielsn]

Summary

• Pin all third-party GitHub Actions to their commit SHAs for supply-chain security
• Each pinned action includes a version comment for readability (e.g., # v4)

Why

Mutable tag references (e.g., @v4) can be overwritten — pinning to commit SHAs ensures reproducible, tamper-resistant CI builds.

Test plan

• Verify all workflows still pass on this branch

[linear]

PLATL-406 Check our CI workflows to ensure any external action used is defined by a SHA version tag.

SHA version tags ensure immutability, even if a supplier does not. In the case of trivy, the latest version was an immutable tag which ensured it could not have been modified.