Pin actions to SHA

[brendandburns]

Similar to kubernetes-client/javascript#2814 we should update our actions to follow the best practices in the security policy here:

https://github.com/kubernetes/community/blob/main/github-management/github-actions-policy.md