pin-deep: you pinned your Actions, but your Actions didn't pin theirs

Everyone knows the drill: pin your GitHub Actions uses: to a commit SHA so a compromised tag can't...