There's no real value in doing it via commit for official GH actions. We
can keep using pinned commits for unofficial actions. It's hassle for no
gain.
Maybe going forward we can limit this further by only being paranoid
for the jobs with any access to tokens.
(cherry picked from commit 35f8649f08341639a627fd06350e938124ca3622)
I've checked over each of these and they're straightforward applications
of the relevant Github Actions.
(cherry picked from commit 9a6761aa35ed84d30bd2fda2333a4fdf3f46ecdc)
