chore: Pin GitHub Actions to commit SHAs

[Arshanwer]

Description

Pin GitHub Actions to commit SHAs instead of version tags.

Testing Instructions

1. Confirm the checks on this pull request pass
2. Spot-check a pin: git ls-remote --tags https://github.com/actions/checkout v4 and compare the v4^{} SHA with the one in the workflow

Checklist

• Does what the author says it will do
• Testing instructions are provided
• Commit messages make sense and follow the conventional commit standard
• No identified security issues
• No identified maintenance issues
• Any third-party libraries/dependencies use the MIT or Apache 2.0 license
• Changes made are backwards compatible and will not break existing setups
• Changes to scripts in the bin/ directory run correctly on both MacOS and WSL
• Changes to containers can be built locally sucessfully (e.g. via tbuild container && tup container)
• Containers/images are compatible with both AMD64 (Windows) and ARM64 (MacOS)
• Changes made to config.php are compatible with our oldest supported Totara version, our newest Totara version, and Moodle

[codyfinegan]

Because I'm rewriting the actions slightly, I've pulled this into #408 instead, closing this PR.