7.10.1: Security: pin GitHub Actions to SHA hashes (#551)

Replaces mutable tag/branch references with immutable SHA hashes
to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026).

Actions left as tags: 0

Co-authored-by: Codacy Security Bot <security-bot@codacy.com>