Pin 3rd party GH actions to commit SHA1.

Author: yruslan

.github/workflows/fossa.yml

@@ -19,6 +19,7 @@ jobs:
         uses: actions/checkout@v6.0.2
 
       - name: Run FOSSA scan and upload build data
-        uses: fossa-contrib/fossa-action@v3.0.1
+        # gh api repos/fossa-contrib/fossa-action/commits/v3.0.1 --jq '.sha'
+        uses: fossa-contrib/fossa-action@v3d2ef181b1820d6dcd1972f86a767d18167fa19b
         with:
           fossa-api-key: ${{secrets.FOSSA_API_KEY}}

.github/workflows/jacoco_check.yml

@@ -60,7 +60,8 @@ jobs:
         run: sbt ++${{matrix.scala}} jacoco -DSPARK_VERSION=${{matrix.spark}}
       - name: Add coverage of 'cobol-parser' to PR
         id: jacocoParser
-        uses: madrapps/jacoco-report@v1.7.2
+        # gh api repos/madrapps/jacoco-report/commits/v1.7.2 --jq '.sha'
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848
         with:
           paths: >
             ${{ github.workspace }}/cobol-parser/target/scala-${{ matrix.scalaShort }}/jacoco/report/jacoco.xml
@@ -75,7 +76,8 @@ jobs:
           echo "Changed Files coverage ${{ steps.jacoco.outputs.coverage-changed-files }}"
       - name: Add coverage of 'spark-cobol' to PR
         id: jacoco
-        uses: madrapps/jacoco-report@v1.7.2
+        # gh api repos/madrapps/jacoco-report/commits/v1.7.2 --jq '.sha'
+        uses: madrapps/jacoco-report@50d3aff4548aa991e6753342d9ba291084e63848
         with:
           paths: >
             ${{ github.workspace }}/spark-cobol/target/scala-${{ matrix.scalaShort }}/jacoco/report/jacoco.xml