ci: update actions via pinact

[mccutchen]

• Adopt pinact for managing GitHub Actions versions, configuring a minimum age of 7 days.
• Update all actions
• Bypass 7 day limit for codecov/codecov-action to pick up fix for Migrating keybase accounts/gpg verification failure codecov/codecov-action#1956

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 94.96%. Comparing base (ae588c5) to head (7b576eb).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #262      +/-   ##
==========================================
+ Coverage   94.81%   94.96%   +0.14%     
==========================================
  Files           9        9              
  Lines        2027     2027              
==========================================
+ Hits         1922     1925       +3     
+ Misses         62       59       -3     
  Partials       43       43              

see 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.