chore: bump github actions to fix Node 20 deprecation warnings (#69)

This PR bumps GitHub Actions to their latest versions and pins them to
strict SHAs, remediating Node 20 deprecation warnings.

.github/workflows/docker-publish-cpu.yml

@@ -43,7 +43,7 @@ jobs:
       contents: read
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       # Free up disk on the runner before BuildKit fills it up. The cargo
       # release build inside the Dockerfile produces multi-GB target dirs
@@ -60,10 +60,10 @@ jobs:
 
       # BuildKit is required for the `cache-from`/`cache-to` options on
       # docker/build-push-action.
-      - uses: docker/setup-buildx-action@v3
+      - uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # v4.4.1
         name: Set up Docker Buildx
 
-      - uses: docker/login-action@v3
+      - uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # v4.6.0
         name: Login to GitHub Container Registry
         with:
           registry: ghcr.io
@@ -80,7 +80,7 @@ jobs:
 
       - id: meta
         name: Compute Docker tags
-        uses: docker/metadata-action@v5
+        uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # v6.2.0
         with:
           images: ghcr.io/storytold/artcraft-services
           tags: |
@@ -89,7 +89,7 @@ jobs:
             type=raw,value=${{ steps.vars.outputs.sha_short }}
 
       - name: Build and push
-        uses: docker/build-push-action@v6
+        uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # v7.4.0
         with:
           context: .
           file: ./build/service_cpu.Dockerfile