chore: pin GitHub Actions to commit SHAs

[lvandenboom]

Summary of changes

• Pins GitHub Actions and reusable workflow references to full-length commit SHAs, per GitHub's secure-use guidance for third-party actions. SHA-pinned refs carry a trailing comment with the original tag/branch for readability.

Checklist

• Added a changelog entry
• Relevant test coverage
• Tested and confirmed flows affected by this change are functioning as expected

Authors

List GitHub usernames for everyone who contributed to this pull request.

Reviewers

@braintree/team-sdk-js

[GoogilyBoogily]

👍 🐸