GitHub Actions workflows should pin versions

[mhucka]

I only recently learned that Google's internal GitHub Actions guidance (go/github-actions) recommends the use of specific runner versions (e.g., ubuntu-22.04 and not ubuntu-latest and similar), and in addition, requires that jobs use actions with versions pinned to specific commit hashes (i.e., not use actions/someaction@v4 but rather actions/someaction@89af9a77r50507asdf7.

[mhucka]

This has been done.