config🔧: pin all GitHub Actions to full-length commit SHAs

Replace version tags (@v1/@v2/@v3/@master) with pinned commit SHAs
across all workflow files to satisfy go-admin-team organization
security policy requiring immutable action references.

.github/workflows/go.yml

@@ -17,13 +17,13 @@ jobs:
     steps:
 
     - name: Set up Go 1.18
-      uses: actions/setup-go@v3
+      uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
       with:
         go-version: 1.18
       id: go
 
     - name: Check out code into the Go module directory
-      uses: actions/checkout@v3
+      uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
     - name: Get dependencies
       run: go mod tidy
@@ -31,7 +31,7 @@ jobs:
       run: make build
 
     - name: Log in to the Container registry
-      uses: docker/login-action@v2
+      uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
       if: startsWith(${{github.ref}}, 'refs/tags/')
       with:
         registry: ${{ env.REGISTRY }}
@@ -41,7 +41,7 @@ jobs:
     - name: Extract metadata (tags, labels) for Docker
       id: meta
       if: startsWith(${{github.ref}}, 'refs/tags/')
-      uses: docker/metadata-action@v4
+      uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
       with:
         images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
         flavor: |
@@ -52,7 +52,7 @@ jobs:
           type=sha,prefix=,format=long,enable=true,priority=100
 
     - name: Build and push Docker image
-      uses: docker/build-push-action@v3
+      uses: docker/build-push-action@1104d471370f9806843c095c1db02b5a90c5f8b6 # v3
       if: startsWith(${{github.ref}}, 'refs/tags/')
       with:
         context: .