🔒 Pin third-party GitHub Actions to commit SHAs

[sepehrsadri]

Third-party GitHub Actions are currently pinned to mutable tags/branches (e.g. setup-packer@main, markdownlint-cli2-action@v22). On a public repo a hijacked upstream tag could run attacker code in CI.

• Pin every non-actions/* third-party action to a full commit SHA
• Confirm Dependabot's github-actions ecosystem is enabled so SHAs stay current
• Replace hashicorp/setup-packer@main with a pinned release SHA

Secret-bearing workflows already use only first-party actions, so the blast radius today is limited to no-secret PR/push CI — but pinning is cheap hardening.