ci: fully hash-pin/qualify all actions with pinact

[woodruffw]

Hi there! Thanks for creating and maintaining cargo neatest! I'm a happy user, both at work and in my own projects 🙂

This PR uses pinact to improve the hermeticity/reproducibility of your GitHub Actions workflows somewhat. I say "somewhat" because there are some lingering action usages that are nontrivial to hash-pin, namely those of dtolnay/rust-toolchain. For the most part those can be replaced with direct use of the stable Rust toolchain that's provided by the action runner itself, but I wanted to leave those for your consideration.

From here, I definitely recommend using Renovate or Dependabot to keep your actions updated and hash-pinned, ideally with a cooldown of at least a week to prevent opportunistic takeovers. I see you already have a Renovate config so I didn't mess with it since I'm not as familiar with Renovate as I am with Dependabot 😅

Finally, I'd definitely recommend taking a look at zizmor for some other CI/CD hardening steps that could be taken here -- I think action pinning is probably the most important/highest impact thing in your case, but if you're interested some other hardening changes I'd be happy to send PRs or help someone else in sending them!

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.12%. Comparing base (80909b7) to head (a6cc13f).

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2780      +/-   ##
==========================================
- Coverage   80.12%   80.12%   -0.01%     
==========================================
  Files         113      113              
  Lines       26167    26167              
==========================================
- Hits        20967    20966       -1     
- Misses       5200     5201       +1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.