chore: pin GitHub Actions to SHA digests

Pin all third-party and reusable GitHub Actions to full SHA commit
digests instead of mutable version tags for improved supply chain
security.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: acoburn

.github/workflows/cd-config.yml

@@ -31,7 +31,7 @@ jobs:
             envName: "Development"
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 17
         uses: actions/setup-java@v5.6.0

.github/workflows/ci-config.yml

@@ -19,7 +19,7 @@ jobs:
       fail-fast: false
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5.6.0
@@ -55,7 +55,7 @@ jobs:
         java: [ 17 ]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5.6.0
@@ -78,7 +78,7 @@ jobs:
         java: [ 17 ]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5.6.0
@@ -98,7 +98,7 @@ jobs:
     if: ${{ github.actor != 'dependabot[bot]' }}
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK 17
         uses: actions/setup-java@v5.6.0

.github/workflows/site-ci-config.yml

@@ -19,7 +19,7 @@ jobs:
         java: [ 17 ]
 
     steps:
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
 
       - name: Set up JDK ${{ matrix.java }}
         uses: actions/setup-java@v5.6.0