Pin GitHub Actions to full commit SHAs

[nerrad]

Changes proposed in this Pull Request:

WooCommerce intends to enforce full-length commit SHA pinning for GitHub Actions across the organization. This pins remote action references in workflows and composite actions to the commits currently identified by their existing tags or branches, retaining those refs in comments. Immutable references reduce the risk that a moved or compromised upstream ref can silently change CI code and narrow the supply-chain compromise surface.

Screenshots:

Not applicable; this changes workflow and composite action configuration only.

Detailed test instructions:

1. Re-run the action reference scanner in check mode and confirm zero unpinned remote action references remain.
2. Run git diff --check.
3. Parse every changed workflow and composite action file as YAML.

All three checks pass on this branch.

Additional details:

No changelog is needed because this changes workflow/action configuration only and is not shipped to merchants.