2.8.7: Security: pin GitHub Actions to SHA hashes (#115)

Replaces mutable tag/branch references with immutable SHA hashes
to prevent supply chain attacks (ref: TeamPCP/Trivy March 2026).

Actions left as tags: 0

Co-authored-by: Codacy Security Bot <security-bot@codacy.com>