chore: pin third-party GitHub Actions to commit SHAs

[pkaeding]

Summary

Pin all third-party GitHub Actions to full-length commit SHAs to prevent supply chain attacks.

Addresses findings from the third-party-action-not-pinned-to-commit-sha Semgrep rule.

Test plan

• Verify CI passes with pinned action SHAs

---

Note

Low Risk
Low risk: this only pins external GitHub Actions to specific commit SHAs; the main risk is CI behavior changing if the pinned revisions differ from the previously floating tags.

Overview
Pins third-party GitHub Actions to immutable commit SHAs for supply-chain hardening.

Updates ruby/setup-ruby in the composite setup action and googleapis/release-please-action in the release workflow to use full commit hashes (with version comments) instead of floating version tags.

^{Written by Cursor Bugbot for commit 7f70e34. This will update automatically on new commits. Configure here.}

[cursor]

Cursor Bugbot has reviewed your changes and found 1 potential issue.

^{Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}