chore: pin third-party GitHub Actions to commit SHAs (#42)

## Summary

Pin all third-party GitHub Actions to full-length commit SHAs to prevent
supply chain attacks.

Addresses findings from the
[`third-party-action-not-pinned-to-commit-sha`](https://github.com/launchdarkly/semgrep-rules/blob/main/github-actions/third-party-action-not-pinned-to-commit-sha.yml)
Semgrep rule.

## Test plan

- [ ] Verify CI passes with pinned action SHAs

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: workflow-only changes that pin action versions; main risk is
CI/release failing if the pinned SHAs are incorrect or later revoked.
> 
> **Overview**
> Pins `googleapis/release-please-action` and
`pypa/gh-action-pypi-publish` to full commit SHAs in the
`release-please` and `manual-publish` workflows (instead of floating
tags), improving supply-chain hardening without changing the release
logic.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
f6b6759. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

Author: osm6495

.github/workflows/manual-publish.yml

@@ -34,6 +34,6 @@ jobs:
 
       - name: Publish package distributions to PyPI
         if: ${{ inputs.dry_run == 'false' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
         with:
             password: ${{env.PYPI_AUTH_TOKEN}}

.github/workflows/release-please.yml

@@ -12,7 +12,7 @@ jobs:
       contents: write # Contents and pull-requests are for release-please to make releases.
       pull-requests: write
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4
         id: release
 
       - uses: actions/checkout@v4
@@ -44,6 +44,6 @@ jobs:
 
       - name: Publish package distributions to PyPI
         if: ${{ steps.release.outputs.releases_created == 'true' }}
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ed0c53931b1dc9bd32cbe73a98c7f6766f8a527e # release/v1
         with:
             password: ${{env.PYPI_AUTH_TOKEN}}