CI actions versions

The CI WF contains a mixture of things like vX and vX.Y.Z, also ubuntu-latest can break anytime they update. We should pin all versions to full version number so that updates fail early and specifically, usually after a dependabot update.