Pin dependencies in ci.yml

Pin dependencies:
- actions/setup-go
- actions/checkout

Bump go versions tested to go-1.19 and go-1.20.

.github/workflows/ci.yml

@@ -31,17 +31,17 @@ jobs:
     strategy:
       matrix:
         os: [macos-latest, ubuntu-latest]
-        go-version: [1.17, 1.18, 1.19]
+        go-version: [1.19, 1.20]
 
     steps:
     - name: Install Go
-      uses: actions/setup-go@v4
+      uses: actions/setup-go@93397bea11091df50f3d7e59dc26a7711a8bcfbe # v4.1.0
       with:
         go-version: ${{ matrix.go-version }}
         check-latest: true
 
     - name: Checkout code
-      uses: actions/checkout@v3
+      uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       with:
         fetch-depth: 1