chore: use SHA for third party actions

(So Sonar shuts up)

Author: markbrockhoff

.github/workflows/precommit-crit-flows.yml

@@ -140,10 +140,10 @@ jobs:
           distribution: 'temurin'
 
       - name: Gradle Cache
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # SHA of tag v5.0.0
 
       - name: Validate Gradle wrapper
-        uses: gradle/actions/wrapper-validation@v3
+        uses: gradle/actions/wrapper-validation@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # SHA of tag v5.0.0
 
       - name: Build the testservice
         run: ./gradlew :testservice:shadowJar