ci: pin 3rd-party action dependencies by commit hashes

Signed-off-by: Daniel Hast <hast.daniel@protonmail.com>

Author: HastD

.github/workflows/check_cirrus_cron.yml

@@ -61,7 +61,7 @@ jobs:
             - if: steps.cron.outputs.failures > 0
               name: Send failure notification e-mail
               # Ref: https://github.com/dawidd6/action-send-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465
@@ -80,7 +80,7 @@ jobs:
 
             - if: failure()
               name: Send error notification e-mail
-              uses: dawidd6/action-send-mail@v3.12.0
+              uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
               with:
                 server_address: ${{secrets.ACTION_MAIL_SERVER}}
                 server_port: 465

.github/workflows/issue_pr_lock.yml

@@ -61,7 +61,7 @@ jobs:
           private-key: ${{ secrets.STALE_LOCKING_APP_PRIVATE_KEY }}
 
       # Ref: https://github.com/dessant/lock-threads#usage
-      - uses: dessant/lock-threads@v5
+      - uses: dessant/lock-threads@1bf7ec25051fe7c00bdd17e6a7cf3d7bfb7dc771 # v5.0.1
         with:
           github-token: '${{ steps.generate-token.outputs.token }}'
           process-only: 'issues, prs'
@@ -73,7 +73,7 @@ jobs:
           log-output: true
       - if: failure()
         name: Send job failure notification e-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

.github/workflows/machine-os-pr.yml

@@ -144,6 +144,6 @@ jobs:
 
       - name: Comment PR link
         if: steps.getversion.outputs.update == 'true' && steps.checkpr.outputs.openpr == 'true'
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@24bffb9b452ba05a4f3f77933840a6a841d1b32b # v3.0.1
         with:
           message: "Building images at: ${{ steps.pr.outputs.uri }}"

.github/workflows/release-artifacts.yml

@@ -235,7 +235,7 @@ jobs:
 
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

.github/workflows/release.yml

@@ -179,7 +179,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     # Note: Windows assigns a UUID to the installer at build time, it's assumed
@@ -359,7 +359,7 @@ jobs:
         run: cat email_body.txt
       - name: Send release notification e-mail
         # Ref: https://github.com/dawidd6/action-send-mail
-        uses: dawidd6/action-send-mail@v3.12.0
+        uses: dawidd6/action-send-mail@2cea9617b09d79a095af21254fbcb7ae95903dde # v3.12.0
         with:
           server_address: ${{secrets.ACTION_MAIL_SERVER}}
           server_port: 465

.github/workflows/upload-win-installer.yml

@@ -101,7 +101,7 @@ jobs:
         echo "TENANT_ID=${{secrets.AZ_TENANT_ID}}" | Out-File -FilePath $env:GITHUB_ENV -Append
         echo "CLIENT_SECRET=${{secrets.AZ_CLIENT_SECRET}}" | Out-File -FilePath $env:GITHUB_ENV -Append
     - name: Pandoc Setup
-      uses: r-lib/actions/setup-pandoc@v2
+      uses: r-lib/actions/setup-pandoc@6f6e5bc62fba3a704f74e7ad7ef7676c5c6a2590 # v2.11.4
       with:
         pandoc-version: '3.1.11'
     - name: Build