fix: pin gh-actions to SHAs, update to remove deprecation warning

[VerteDinde]

This PR makes two changes to CI:

• Updates existing GH actions to remove the save-state deprecation warning (fixes The save-state command is deprecated and will be disabled soon. #2955)
• Pins GH actions to a SHA rather than a tag (the corresponding tag has been left as a comment)

• I have read the contribution documentation for this project.
• I agree to follow the code of conduct that this project follows, as appropriate.
• The changes are appropriately documented (if applicable).
• The changes have sufficient test coverage (if applicable).
• The testsuite passes successfully on my local machine (if applicable).

[codecov]

Codecov Report

Merging #2966 (36d4529) into main (362099a) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #2966   +/-   ##
=======================================
  Coverage   73.80%   73.80%           
=======================================
  Files          66       66           
  Lines        2142     2142           
  Branches      424      424           
=======================================
  Hits         1581     1581           
  Misses        356      356           
  Partials      205      205           

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 362099a...36d4529. Read the comment docs.

[erickzhao]

CI passes lgtm