CI: Hash-pin all actions

[woodruffw]

(Sorry for using a blank issue for this! None of the other templates seemed exactly right.)

I'm proposing that CPython's CI switch to fully-hash-pinned GitHub Actions references. This is enforced by default via zizmor, but currently CPython's configuration relaxes that default here:

cpython/.github/zizmor.yml

Line 10 in 17070f4

"*": ref-pin

Doing so should be a non-breaking change: the versions resolved will be the same as before, and tools like Dependabot/Renovate/pinact will continue to be able to update any action references, including their hashes.

Ref: https://docs.zizmor.sh/audits/#unpinned-uses

CC @sethmlarson

Linked PRs

• gh-146488: hash-pin all action references #146489