Favor SHA hashes for reusable workflows

[jzheaux]

Motivated specifically spring-io/spring-security-release-tools#87, and more generally by using commit hashes makes our build more predictable and more secure since they are immutable.