ci(actions): Pin action versions by hash

[nickvergessen]

Resolves:

warning[artipacked]: credential persistence through GitHub Actions artifacts
--> .github/workflows/codeql.yml:34:7
|
34 | - name: Checkout repository
| _______^
35 | | uses: actions/checkout@v5
| |_______________________________^ does not set persist-credentials: false
|
= note: audit confidence → Low
= note: this finding has an auto-fix

Checklist

• Code is properly formatted
• Sign-off message is added to all commits
• Tests (unit, integration, api and/or acceptance) are included
• Screenshots before/after for front-end changes
• Documentation (manuals or wiki) has been updated or is not required
• Backports requested where applicable (ex: critical bugfixes)
• Labels added where applicable (ex: bug/enhancement, 3. to review, feature component)
• Milestone added for target branch/version (ex: 32.x for stable32)

[nickvergessen]

/backport to stable32