chore: harden GitHub Actions workflows

[jonathan343]

Note

There are some actions NOT pinned to the latest or consistent versions. This PR intentionally preserves the currently used versions to prevent any possible breakages that come with upgrading. The scope is to make action references immutable and address the zizmor findings, not to upgrade actions to their latest releases.

Overview

This PR hardens several GitHub Actions workflows to resolve zizmor findings around action pinning, token scope, credential persistence, and shell template expansion.

I highly recommend the team considers the following:

• Open a follow up PR to get actions onto their latest versions
• Configure Dependabot or Renovate to keep actions up to date.
• Implement a mechanism to prevent regressions. This can be done through configuring zizmor as a pre-commit hook or integrate it into your CI. Note: The aws org has some limitations against third-party actions so avoid using zizmor-action for now.

Summary

• Pins GitHub Actions uses: references to full commit SHAs while retaining version comments for readability.
• Sets persist-credentials: false for checkout steps that do not need persisted Git credentials.

These changes address the relevant zizmor audit guidance for unpinned-uses and excessive-permissions.

---

By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.