github: Pin external GitHub Actions to hashes

[radeksimko]

The intention here is to reduce the security risk posed by the supply chain - i.e. externally maintained GitHub Actions.

The expectation is that dependabot will continue to update these hashes as and when new versions become available.

[mdeggies]

Looks good, thanks for doing this. I don't see a dependabot config file, which I believe is needed unless you're opting into it another way. We're adding these across projects, ex: https://github.com/hashicorp/crt-core-helloworld/blob/main/.github/dependabot.yml.

[radeksimko]

@mdeggies Good catch! I've added one to the PR, PTAL.

[mdeggies]

Awesome! Thanks again :)