ci: Pin GitHub Actions to immutable commit SHAs

[AnzalKhan16]

Description

This PR addresses software supply chain security risks by replacing all mutable version tags (e.g., @v4, @v5) used in our GitHub Actions workflows with their corresponding immutable commit SHAs.

Previously, workflows relied on mutable tags which could be modified by the action authors, potentially introducing breaking changes or malicious code unexpectedly. By pinning dependencies to strict commit hashes, we ensure that every execution of the CI pipeline is exactly reproducible and resilient to untracked upstream modifications. As a standard best practice, the original version tags have been retained as comments (e.g., # v4) alongside the SHAs to improve readability and maintainability for future dependency updates.

Related Issues

#2401

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update / Security / Maintenance

How Has This Been Tested?

The change has been validated by successfully resolving the target commits associated with the used tags for each action in the repository (such as actions/checkout, actions/setup-python, aquasecurity/trivy-action, etc.). A comprehensive audit script was used to fetch the SHAs directly from the official remote repositories using git ls-remote, ensuring accurate mappings for all integrations without altering their underlying behavior.

Checklist

• My code follows the code style of this project.
• I have performed a self-review of my own code.
• I have commented my code, particularly in hard-to-understand areas.
• I have made corresponding changes to the documentation.
• My changes generate no new warnings.

[utksh1]

Approved after reviewing the focused diff and passing required checks.