chore(deps): bump the actions group with 5 updates

.github/workflows/affinescript-verify.yml

@@ -102,7 +102,7 @@ jobs:
         # advisory: setup failures should surface as signal without blocking
         # unrelated standards changes while AffineScript verification matures.
         continue-on-error: true
-        uses: ocaml/setup-ocaml@e89b2ded52a6e13f50162220cf5fe47290162032 # v3
+        uses: ocaml/setup-ocaml@93303b622b2522e4411e295f9e77411a24912ac7 # v3
         with:
           ocaml-compiler: "5.1"
 

.github/workflows/codeql-reusable.yml

@@ -94,12 +94,12 @@ jobs:
           persist-credentials: false
 
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/init@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v3
         with:
           languages: ${{ inputs.language }}
           build-mode: ${{ inputs.build-mode }}
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/analyze@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v3
         with:
           category: "/language:${{ inputs.language }}"

.github/workflows/hypatia-scan-reusable.yml

@@ -237,7 +237,7 @@ jobs:
         # This flag only tolerates a genuine upload failure (e.g. Advanced
         # Security disabled on a private repo) once the job is actually running.
         continue-on-error: true
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v3
         with:
           sarif_file: hypatia.sarif
           category: hypatia

.github/workflows/mirror-reusable.yml

@@ -408,7 +408,7 @@ jobs:
       # answers "are we configured to actually do it?".
       - name: Setup Rust
         if: ${{ env.RADICLE_KEY != '' }}
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable
         with:
           toolchain: stable
       - name: Install Radicle

.github/workflows/rust-ci-reusable.yml

@@ -176,7 +176,7 @@ jobs:
         # `@stable`), but a SHA ref carries no version, so the action's "parse
         # toolchain version" step fails with `'toolchain' is a required input`.
         # See standards estate-wide rust-ci red.
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable
         with:
           toolchain: stable
           components: clippy, rustfmt
@@ -225,7 +225,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable
         with:
           toolchain: stable
 
@@ -274,7 +274,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable
         with:
           toolchain: stable
 
@@ -310,7 +310,7 @@ jobs:
 
       - name: Install Rust toolchain
         # `toolchain:` mandatory under SHA pin — see Cargo check job above.
-        uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # stable
         with:
           toolchain: stable
           components: llvm-tools-preview

.github/workflows/scorecard-reusable.yml

@@ -92,7 +92,7 @@ jobs:
             printf 'reconciled=false\n' >> "$GITHUB_OUTPUT"
           fi
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v3
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v3
         with:
           sarif_file: ${{ steps.select-sarif.outputs.file }}
 
@@ -225,7 +225,7 @@ jobs:
             printf 'reconciled=false\n' >> "$GITHUB_OUTPUT"
           fi
       - name: Upload SARIF to code scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
+        uses: github/codeql-action/upload-sarif@1c5b675653bb5c22dbe9b12b556ec555138e09fd # v4.38.1
         with:
           sarif_file: ${{ steps.select-sarif.outputs.file }}
       - name: Retain scan evidence