ci(actions): pin the third-party actions to commit SHAs

CodeQL flagged docker/setup-buildx-action, docker/login-action,
docker/build-push-action and cypress-io/github-action as unpinned: a
moving v3 or v6 tag lets whoever controls it change what runs with the
workflow's GHCR write token.

Each action is now pinned to the commit its tag points to today, with
the exact release as a trailing comment (v3.12.0, v3.7.0, v6.19.2,
v6.10.9), resolved through the GitHub API, so the code that runs does
not change. GitHub's own actions/* were not flagged and keep their tags.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci.yml

@@ -70,11 +70,11 @@ jobs:
 
       - name: Set up Docker Buildx
         if: steps.semver.outputs.found == 'true'
-        uses: docker/setup-buildx-action@v3
+        uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
 
       - name: Login to GHCR
         if: steps.semver.outputs.found == 'true'
-        uses: docker/login-action@v3
+        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3.7.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -82,7 +82,7 @@ jobs:
 
       - name: Build and publish image
         if: steps.semver.outputs.found == 'true'
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@10e90e3645eae34f1e60eeb005ba3a3d33f178e8 # v6.19.2
         with:
           context: .
           file: ./Dockerfile

.github/workflows/tests.yml

@@ -190,7 +190,7 @@ jobs:
             xvfb
 
       - name: Run Cypress tests
-        uses: cypress-io/github-action@v6
+        uses: cypress-io/github-action@f790eee7a50d9505912f50c2095510be7de06aa7 # v6.10.9
         with:
           working-directory: app
           install: false