UID2-6793: Pin external GitHub Actions to SHA hashes

[jon8787]

Summary

• Pin all third-party GitHub Action references to full-length commit SHAs for supply chain security
• Internal IABTechLab reusable workflows and composite actions remain tag-pinned

Test plan

• Verify CI workflows pass on this branch
• Spot-check that IABTechLab shared action references still have correct subpaths

🤖 Generated with Claude Code

Part of UID2-6793