This PR includes automated changes from running frizbee to pin Github Actions. For more information on what this actually means, take a look at our documentation on UnpinnedActions. Because frizbee will be replacing tags with their corresponding commit hash, this change should fundamentally be a no-op. This change just makes our code more explicit about what we're using.

Note that because we're touching Github Workflow files in this PR, there is a chance that Claws, our GHA Static Analyzer, will find other issues in those files that were introduced before this PR was created. These findings will need to be addressed before this PR can be merged.

The Claws documentation has a good list for how to remediate each type of finding, but for brevity, here are some of the commonly seen ones:

• RiskyTriggers: Fires when a workflow has workflow_dispatch or pull_request_target; remediate by leaving comments explaning why, and put an ignore statement (example)
• UnsafeCheckout: Fires when a workflow checks out user supplied code; remediate by leaving a comment explaining how the user supplied code is used and confirm it isn't executed (example)

For other findings and how to remediate them, check the Claws docs!