[CI][Security]: Use sha checksum references for all 3rd party Github workflow actions

[aatchison]

cc @kewisch
Security best practices doc:
https://docs.github.com/en/actions/reference/security/secure-use

Can we use this action to validate?
https://github.com/zizmorcore/zizmor