ci: use full-length commit sha for github owned actions

[Fdawgs]

Use full-length commit sha for github owned actions just to be on safe side, especially after https://github.blog/security/investigating-unauthorized-access-to-githubs-internal-repositories/

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions supply chain by pinning GitHub-owned actions to full-length commit SHAs instead of floating version tags, aligning with GitHub’s post-incident guidance.

Changes:

• Pin actions/checkout to a full commit SHA in CI, CD, and CodeQL workflows.
• Pin actions/setup-node to a full commit SHA in CI and CD workflows.
• Pin github/codeql-action (init and analyze) to a full commit SHA in the CodeQL workflow.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/codeql.yml	Pins actions/checkout and github/codeql-action steps to full commit SHAs for more reliable provenance.
.github/workflows/ci.yml	Pins actions/checkout and actions/setup-node to full commit SHAs in the unit test job.
.github/workflows/cd.yml	Pins actions/checkout and actions/setup-node to full commit SHAs for publish jobs.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.