fix(ci): correct gradle/actions v4 commit SHA pin

Zizmor's `impostor-commit` audit failed because the SHA I used
(0b6dd653...) was the v4 *tag object* SHA, not the commit it
dereferences to. gradle/actions uses nested annotated tags — v4
points to another tag (48b5f213...) which points to commit
ed408507eac0... That last hop is what should be pinned.

setup-java@v4 was already correct (resolves directly to a commit).

Author: jfblaa

.github/workflows/e2e-tests.yml

@@ -73,7 +73,7 @@ jobs:
           distribution: temurin
           java-version: '21'
 
-      - uses: gradle/actions/setup-gradle@0b6dd653ba04f4f93bf581ec31e66cbd7dcb644d # v4
+      - uses: gradle/actions/setup-gradle@ed408507eac070d1f99cc633dbcf757c94c7933a # v4
         with:
           gradle-version: '9.2.1'