Pin GitHub Actions to Apache-approved commit hashes

Replace version tags with pinned commit hashes from apache/infrastructure-actions approved_patterns.yml for supply chain security compliance.

- gradle/actions/setup-gradle@v4 -> @017a9eff (v4.4.2) in rendersite.yml

- gradle/actions/setup-gradle@v5 -> @07231958 (v5.0.2) in gradle.yml, publish.yml

- scacap/action-surefire-report@v1 -> @5609ce4d (v1.9.1) in gradle.yml

Assisted-by: Claude Code <Claude@Claude.ai>

Author: jamesfredley

.github/workflows/gradle.yml

@@ -23,15 +23,15 @@ jobs:
           distribution: liberica
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
           develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
       - name: Run Tests
         run: |
           (set -x; ./gradlew clean check --no-daemon)
       - name: Publish Test Report
         if: failure()
-        uses: scacap/action-surefire-report@v1
+        uses: scacap/action-surefire-report@5609ce4db72c09db044803b344a8968fd1f315da # v1.9.1
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           report_paths: '**/build/test-results/test/TEST-*.xml'

.github/workflows/publish.yml

@@ -38,7 +38,7 @@ jobs:
           distribution: liberica
           java-version: 17
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v5
+        uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
           develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
       - name: Publish Main Site

.github/workflows/rendersite.yml

@@ -11,7 +11,7 @@ jobs:
           java-version: 17
           distribution: liberica
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v4
+        uses: gradle/actions/setup-gradle@017a9effdb900e5b5b2fddfb590a105619dca3c3 # v4.4.2
         with:
           develocity-access-key: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
       - name: Render HTML for Site