Pin actions to hashes

[A5rocks]

https://astral.sh/blog/open-source-security-at-astral reminded me it would be very nice to pin actions to hashes. They even link to https://github.com/suzuki-shunsuke/pinact which we can probably stuff into autodeps!

[jakkdl]

I've started using https://github.com/renovatebot/renovate in a repository, and it (among many many other things) supports updating github actions pinned to SHA's https://docs.renovatebot.com/modules/manager/github-actions/#digest-pinning-and-updating