chore: pin third-party GitHub Actions to commit SHAs (#148)

## Summary

Pin all third-party GitHub Actions to full-length commit SHAs to prevent
supply chain attacks.

Addresses findings from the
[`third-party-action-not-pinned-to-commit-sha`](https://github.com/launchdarkly/semgrep-rules/blob/main/github-actions/third-party-action-not-pinned-to-commit-sha.yml)
Semgrep rule.

## Test plan

- [ ] Verify CI passes with pinned action SHAs

<!-- CURSOR_SUMMARY -->
---

> [!NOTE]
> **Low Risk**
> Low risk: this only pins existing third-party GitHub Actions to
specific commit SHAs and should not change workflow behavior beyond
ensuring the exact action revision used.
> 
> **Overview**
> Pins third-party GitHub Actions used in CI workflows to immutable
commit SHAs.
> 
> Updates `lint-pr-title.yml` to lock
`amannn/action-semantic-pull-request` and `release-please.yml` to lock
`googleapis/release-please-action`, reducing supply-chain risk while
keeping the same action major versions.
> 
> <sup>Written by [Cursor
Bugbot](https://cursor.com/dashboard?tab=bugbot) for commit
bba70c7. This will update automatically
on new commits. Configure
[here](https://cursor.com/dashboard?tab=bugbot).</sup>
<!-- /CURSOR_SUMMARY -->

---------

Co-authored-by: Todd Anderson <127344469+tanderson-ld@users.noreply.github.com>

Author: pkaeding

.github/workflows/lint-pr-title.yml

@@ -12,6 +12,6 @@ jobs:
     name: Verify the PR title matches conventional commit spec.
     runs-on: ubuntu-latest
     steps:
-      - uses: amannn/action-semantic-pull-request@v5
+      - uses: amannn/action-semantic-pull-request@e32d7e603df1aa1ba07e981f2a23455dee596825 # v5
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release-please.yml

@@ -18,7 +18,7 @@ jobs:
       package-server-sdk-redis-store-released: ${{ steps.release.outputs['lib/java-server-sdk-redis-store--release_created'] }}
 
     steps:
-      - uses: googleapis/release-please-action@v4
+      - uses: googleapis/release-please-action@16a9c90856f42705d54a6fda1823352bdc62cf38 # v4.4.0
         id: release
         with:
           token: ${{ secrets.GITHUB_TOKEN }}