ci: pin github actions by commit sha at current versions

[NoopDog]

Closes #4893

Upgrades every action reference in the workflows to its current version and converts all tag pins to commit SHA pins with version comments, exactly per the table in #4893. Each SHA was resolved and verified against the upstream tag. Same change already merged and green in anvilproject/anvil-portal#4040.

Test plan

• Workflows that trigger on pull requests validate the new pins on this PR itself.
• Workflows that only run on push to the default branch or on dispatch complete a green run after merge, via the next natural trigger or a manual dispatch, with no Node deprecation annotations.
• After the green runs, the allowlist tightening described in Upgrade GitHub Actions to current majors (SHA-pinned) and tighten Actions allowlist #4893 (remove the actions/* wildcard) is applied and the push/dispatch workflows are re-verified.

🤖 Generated with Claude Code