fix(ci): pin third-party actions to full commit SHAs (#54)

fix(ci): pin third-party actions to full commit SHAs

The account's Actions policy requires a full-length SHA ref. A tag or
branch ref is refused at
startup — `startup_failure`, no jobs, "this workflow graph cannot be
shown" — so these workflows
could not run at all. This resolves each ref to the commit it currently
points at and records the
ref in a trailing comment, e.g. `actions/checkout@<sha> # v4`.

`dtolnay/rust-toolchain` takes its toolchain from the ref itself, so
those steps also gained an
explicit `with: toolchain:` input; without it, a SHA ref would silently
lose the channel.

No behaviour is intended to change beyond the pins.

Author: hyperpolymath

netstack/.github/workflows/ci.yml

@@ -78,7 +78,7 @@ jobs:
       - name: Checkout
         uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v4
       - name: Link Checker
-        uses: lycheeverse/lychee-action@v2.7.0
+        uses: lycheeverse/lychee-action@a8c4c7cb88f0c7386610c35eb25108e448569cb0  # v2.7.0
         with:
           args: --verbose --no-progress '**/*.md' '**/*.adoc'
           fail: true