ci: pin third-party GitHub Actions to immutable commit SHAs

[loulanyue]

Summary

Pins third-party GitHub Actions across all CI workflows to immutable commit SHAs.

Fixes #3287

Changes

Updated .github/workflows/release.yml, .github/workflows/rust-ci.yml, and .github/workflows/rust.yml to replace floating @vN action references with immutable full commit hashes while preserving the human-readable version comment:

• actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
• actions/setup-python@42375524e23c412d93fb67b49958b491fce71c38 # v5.4.0
• actions/upload-artifact@4cec3d8aa04e39d1a68397de0c4cd6fb9dce8ec1 # v4.6.1
• dtolnay/rust-toolchain@4360b52568e2003a75bf9bc1d59f33a8e3fc893c # stable
• Swatinem/rust-cache@400e7407cfd7a091e5fbb6afec01ec146c432b7c # v2.7.7
• softprops/action-gh-release@c95fe1489396fe8a9eb87c0abf8aa5b2ef267fda # v2.2.1

Verification

Passed doc source-of-truth and release readiness checks locally.

[1716775457damn]

Good security hardening — pinning floating @vn tags to immutable commit SHAs kills supply-chain risk from tag re-pointing, and keeping the human-readable version comment is the right trade-off for maintainability. One nit: since actions/checkout is pinned but the workflow itself is invoked from a fixed ref too, everything here looks consistent. Approving direction; the change closes #3287.

[1716775457damn]

Good call on pinning to immutable SHAs — floating @vN tags are rewritable, so an action author's account being compromised is enough to inject arbitrary code into a workflow that has access to release secrets. That's exactly the supply-chain vector behind the tj-actions/changed-files incident. Keeping the # v4.2.2 trailing comment is the right call too, since a bare SHA is unreadable when you're debugging a failing run.

One suggestion to keep these from going stale: enable Dependabot for the github-actions ecosystem. It rewrites the SHA and keeps the version comment in sync automatically, so you keep the security property without the manual upgrade burden.