security: pin GitHub Actions dependencies to SHA hashes

- actions/checkout@v4.3.1 (34e11487)
- shivammathur/setup-php@v2.36.0 (44454db4)
- softprops/action-gh-release@v2.5.0 (a06a81a0)

Author: miguelcolmenares

.github/workflows/release.yml

@@ -20,10 +20,10 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - name: Setup PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@44454db4f0199b8b9685a5d763dc37cbf79108e1 # v2.36.0
         with:
           php-version: '8.2'
           tools: composer
@@ -79,7 +79,7 @@ jobs:
           ./scripts/build-release.sh "${{ steps.version.outputs.version }}"
 
       - name: Create GitHub Release
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@a06a81a03ee405af7f2048a818ed3f03bbf83c7b # v2.5.0
         with:
           tag_name: v${{ steps.version.outputs.version }}
           name: v${{ steps.version.outputs.version }}