[github] Add commit hashes to action dependencies

[VenelinBakalov]

Description

Checklist

• I have added relevant error handling and logging messages to help troubleshooting
• I have added tests that prove my fix is effective or that my feature works
• I have added necessary documentation, relevant usage information (if applicable)
• I have updated the PR title with affected component, related issue number and a short summary of the changes introduced
• I have added labels for implementation kind (kind/) and version type (version/)
• I have tested against live environment, if applicable
• I have synced any structure and/or content vRA-NG improvements with vra-ng and ts-vra-ng archetypes (if applicable)
• I have my changes rebased and squashed to the minimal number of relevant commits. Notice: don't squash all commits
• I have added a descriptive commit message with a short title, including a Fixed #XXX - or Closed #XXX - prefix to auto-close the issue

Testing

Release Notes

Related issues and PRs

Closes the following security issues:
https://github.com/vmware/build-tools-for-vmware-aria/security/code-scanning/192
https://github.com/vmware/build-tools-for-vmware-aria/security/code-scanning/194
https://github.com/vmware/build-tools-for-vmware-aria/security/code-scanning/195
https://github.com/vmware/build-tools-for-vmware-aria/security/code-scanning/196
https://github.com/vmware/build-tools-for-vmware-aria/security/code-scanning/197

[vmwclabot]

@VenelinBakalov, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit e01e82e must be signed by [email protected]

[vmwclabot]

@VenelinBakalov, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit e01e82e must be signed by [email protected]