[security] action sha pinning - Addresses issue 378

[abacchilb]

Summary
Pins first-party GitHub Actions to full commit SHAs and aligns all workflows on the same v4 versions of actions/checkout, actions/setup-node, actions/upload-artifact, and actions/download-artifact.

Inspired by issue #378

Why
Tag-based refs (@v4) can move if the tag is updated. Pinning to SHAs matches GitHub’s guidance for supply-chain safety and keeps CI using a known immutable revision.

Changes
Replace @V3 / @v4 tags with pinned SHAs and short # v4 comments where helpful.
Use actions/checkout@v4 and actions/setup-node@v4 consistently across test-on-pr.yml, create-artifact.yml, and build-and-release.yml.

Summary by Aikido

Security Issues: 0	Quality Issues: 0	Resolved Issues: 0

⚡ Enhancements

• Pinned GitHub Actions refs to full commit SHAs for security
• Aligned workflows to consistent v4 versions of core actions

^{More info}