chore: update GitHub Action pins

[nikzen]

Summary

• Pin all external GitHub Actions in workflows to current upstream default-branch commit SHAs.
• Includes actions discovered from every uses: entry in .github/**/*.yml and .github/**/*.yaml.

Verification

• Commit is GPG-signed locally.
• CI on this PR should validate the updated action refs.

[github-actions]

* cc80893b9a769ff24efce5879b7a54be35b653f0 chore: update GitHub Action pins
|   - Error: Could not find a certificate with BDE15DDCE302F9E417F426D9A575DDEB3DB7D052 in the policy file
* 1e655615211ea0664080b31411868ed8ce360273 feat(fca-tools): add scripts for mTLS Root CA
    - Trust root.

Failed to authenticate commits.

Error: Could not verify commits 1e655615211ea0664080b31411868ed8ce360273..cc80893b9a769ff24efce5879b7a54be35b653f0

Caused by:
    0: While verifying commit cc80893b9a769ff24efce5879b7a54be35b653f0
    1: Could not find a certificate with BDE15DDCE302F9E417F426D9A575DDEB3DB7D052 in the policy file