fix(ci): SHA-pin third-party GitHub Actions (#72)

Pin all third-party actions to their current commit SHA to prevent
tag-repoint attacks. Mutable tags (release/v1, v7, etc.) are kept as
trailing comments for readability and Dependabot version tracking.

Actions pinned:
.github/workflows/pypi-publish-on-release.yml

Author: max-rattray-aws

.github/workflows/pypi-publish-on-release.yml

@@ -92,4 +92,4 @@ jobs:
         name: python-package-distributions
         path: dist/
     - name: Publish distribution 📦 to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@cef221092ed1bacb1cc03d23a2d87d1d172e277b # release/v1