chore(ci): pin 3rd party actions to sha commit

[am29d]

Description of your changes

I have pinned the version of the following actions in our workflows:

• actions/cache
• flochaz/pkg-size-action
• release-drafter/release-drafter

Closes #1025.

I have added the workflow from python repo to check for any unpinned using zgosalvez/github-actions-ensure-sha-pinned-actions workflow.

How to verify this change

Related issues, RFCs

Issue number: #1025

PR status

Is this ready for review?: YES
Is it a breaking change?: NO

Checklist

• My changes meet the tenets criteria
• I have performed a self-review of my own code
• I have commented my code where necessary, particularly in areas that should be flagged with a TODO, or hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding changes to the examples
• My changes generate no new warnings
• The code coverage hasn't decreased
• I have added tests that prove my change is effective and works
• New and existing unit tests pass locally and in Github Actions
• Any dependent changes have been merged and published
• The PR title follows the conventional commit semantics

Breaking change checklist

• I have documented the migration process
• I have added, implemented necessary warnings (if it can live side by side)

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.

[dreamorosi]

I think we should pin also the aws-actions/configure-aws-credentials action (used here & elsewhere), while not strictly third-party (for us at least). Doing that would open the door to address most of the warnings described in #1127, which we need to fix anyway before end of Q2.

Finally, should we pin the ones from GitHub (aka the ones that start with actions/*) or is it not necessary?

[am29d]

Pinned aws-actions/configure-aws-credentials to latest commit of v1-node16, they we will get a v2 release soon.
Other actions/* I'd keep in the allow list similar to powertools python repo.

[dreamorosi]

Looks great, let's go!!