ci: pin all third-party GitHub Actions to immutable commit SHAs

- actions/checkout: v4 → 11d5960a326750d5838078e36cf38b85af677262
- actions/setup-python: v5 → a26af69be951a213d495a4c3e4e4022e16d87065
- actions/upload-artifact: v4 → ea165f8d65b6e75b540449e92b4886f43607fa02
- dtolnay/rust-toolchain: stable → 686976e191b89faba57d3206551f0f330d8cb249
- Swatinem/rust-cache: v2 → 49a0bdc70d2e1b713ca9e2869b211fcce03d3c1c
- softprops/action-gh-release: v2 → 3bb12739c298aeb8a4eeaf626c5b8d85266b0e65

Improves supply chain security by pinning Actions to specific commits
instead of mutable tag references, preventing unexpected behavior changes
if action maintainers update tags.

Fixes #3287

.github/workflows/rust.yml

@@ -18,7 +18,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
     - name: Build
       run: cargo build --verbose
     - name: Run tests