chore: pin GitHub Actions to full commit SHAs (SDK-738)

[brax10ward]

Linear Link

SDK-738 — Pin GitHub Actions to full commit SHAs

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Refactor (non-breaking change which cleans up code)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• This change requires a documentation update
• This change impacts security

Pins every third-party uses: across .github/workflows/ to a full 40-char commit SHA. Addresses the Semgrep github-actions-mutable-action-tag findings on #175 plus every other mutable ref in the tree — actions/checkout, actions/setup-node, actions/cache, actions/upload-artifact, maxim-lobanov/setup-xcode, actions/github-script. The atomicfi/sdk-release-notifications reusable workflow ref is left at @main (first-party, not flagged).

Note: #175 will need a rebase (or Dependabot will regenerate it) once this merges, since the @v6/@v7 refs it targets are gone.

Checklist:

• New and existing tests pass locally with my changes
• I have performed a self-review of my own code
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have tested on a physical iOS device and Android device
• I have added tests that prove my fix is effective or that my feature works
• I have followed the Code Review and Code Review Security guidelines
• I have checked my code against flaws from the OWASP Top 10
  • A01:2021-Broken Access Control
  • A02:2021-Cryptographic Failures
  • A03:2021-Injection
  • A04:2021-Insecure Design
  • A05:2021-Security Misconfiguration
  • A06:2021-Vulnerable and Outdated Components
  • A07:2021-Identification and Authentication Failures
  • A08:2021-Software and Data Integrity Failures
  • A09:2021-Security Logging and Monitoring Failures
  • A10:2021-Server-Side Request Forgery