[MEDIUM] Pin workflow actions to immutable commits

[OskarEichler]

Summary

• Pin every GitHub Actions dependency to the immutable commit currently selected by its existing ref.
• Preserve each selected tag or branch in a comment.
• Cover both CI and the RubyGems trusted-publishing release job.

Security impact

The release workflow grants id-token: write and delegates package publication to rubygems/release-gem@v1. Mutable action refs can change after review, allowing different third-party code to execute in the publishing boundary without a corresponding http-2 repository diff.

The CI action refs are pinned at the same trust boundary, including the mutable support-simplecov-1 branch.

Verification

• rbenv exec bundle exec rake: 448 examples, 0 failures; 41 RuboCop files, no offenses
• rbenv exec bundle exec rake build
• Parsed both workflow files with Ruby YAML
• Confirmed all 10 action references use 40-character commits
• git diff --check

No repository tests were changed.

Limitations

Hosted CI, artifact transfer, coverage reporting, and the RubyGems OIDC release were not exercised locally. Workflow inputs, permissions, and selected action revisions are otherwise unchanged.

Breaking changes

None. Runtime code, dependencies, workflow behavior, and selected action versions are unchanged.

[HoneyryderChuck]

not sure what to think of this one honestly. I don't see what the ref pinning buys us in this case, vs just setting the version and knowing automatically how behind one is.