Replace unpinned actions with pinned action

[stacklokbot]

This is a Minder automated pull request.

This pull request replaces references to actions by tag to references to actions by SHA.

Verifies that any actions use pinned tags
Pinning an action to a full length commit SHA is currently the only way to use
an action as an immutable release. Pinning to a particular SHA helps mitigate
the risk of a bad actor adding a backdoor to the action's repository, as they
would need to generate a SHA-1 collision for a valid Git object payload.
When selecting a SHA, you should verify it is from the action's repository
and not a repository fork.

For more information, see
https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you sign our Contributor License Agreement before we can accept your contribution.

---

Stacklok Bot seems not to be a GitHub user. You need a GitHub account to be able to sign the CLA. If you have already a GitHub account, please add the email address used for this commit to your account.
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[rdimitrov]

cc: @dussab

[dussab]

The issue might be related to the fact the CLA Tool cannot determine the user account associated with the commit. The Stacklok bot commit seems to be missing the email address associated with the Stacklokbot commit. Here is the commit for reference: https://github.com/stacklok/minder/commit/a25953167b4774c52a930645714f97cf9c68be4c.patch @jhrozek is investigating this further.