pin github action SHAs

[bmuenzenmeyer]

top-level guidance is coming for this someday, but for now you can review this reference: https://blog.rafaelgss.dev/why-you-should-pin-actions-by-commit-hash

[colindean]

What tooling exists for resolving this, or would it be best to let dependabot handle that (#9)?

[colindean]

I'm going to hold off on doing this manually unless you think I really should do it sooner than later.

[bmuenzenmeyer]

Dependabot can do this