Consider pinning GitHub Actions versions to SHA hashes

[nathanjmcdougall]

Currently, GitHub actions are pinned via git tag e.g. uses: PyO3/maturin-action@v1

This presents a moderate security risk since git tags are not immutable. A malicious actor who gains control of the upstream repo can force-push onto the tag. For more information, see here from the zizmor scanning tool docs and here from GitHub. This is less of a concern for official GitHub repos like actions/upload-artifact@v4 but more of a concern for less-popular actions like extractions/setup-just@v3

You can automatically migrate/maintain these with tools like https://github.com/suzuki-shunsuke/pinact

You can also require this at the project settings level