chore(sec): pin github deps to shas

[CommanderStorm]

Launch Checklist

Our CI uses a few actions.
For these actions, we currently just use the mutable GitHub tag.

Since we use Dependabot to update the versions, we should use SHAs.
This makes sure that we are not affected by a certain class of supply chain vulnerability where attackers re-publish bad tags.

Using SHAs matches GitHub recommendations and is a part of the OpenSSFs Scorecard.

• Confirm your changes do not include backports from Mapbox projects (unless with compliant license) - if you are not sure about this, please ask!
• Add an entry to CHANGELOG.md under the ## main section.
  ^--- not sure if you want this. Other maintenance actions don't show up as well.

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 46.48%. Comparing base (8cd5e28) to head (489364b).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #1444      +/-   ##
==========================================
- Coverage   46.49%   46.48%   -0.02%     
==========================================
  Files         111      111              
  Lines       10628    10628              
  Branches     2220     2220              
==========================================
- Hits         4942     4940       -2     
- Misses       5592     5594       +2     
  Partials       94       94              

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.