Lock down allowed github actions versions

[garyschulte]

Similar to hyperledger/besu we should lock the actions down to specific SHAs instead of using aliases. It is safer and can help avoid a ci supply chain attack

[macfarla]

ref #236