chore: pin all GH Actions to a specific SHA (#1772)

Co-authored-by: Kyle Mendell <kyle@pocket-id.org>

.github/workflows/pr-quality.yml

@@ -12,7 +12,7 @@ jobs:
     steps:
       - name: Create bot app token
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.BOT_APP_CLIENT_ID }}
           private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
@@ -20,7 +20,7 @@ jobs:
           permission-issues: read
           permission-pull-requests: write
 
-      - uses: peakoss/anti-slop@v0
+      - uses: peakoss/anti-slop@57858eead489d08b255fab2af45a506c2ca6eab2 # v0.3.0
         with:
           github-token: ${{ steps.app-token.outputs.token }}