ci(benchmark): pin actions to commit-hash (#772)

closes https://github.com/fastify/fast-json-stringify/security/code-scanning/22 and https://github.com/fastify/fast-json-stringify/security/code-scanning/21

Signed-off-by: Frazer Smith <[email protected]>

Author: Fdawgs

.github/workflows/benchmark.yml

@@ -17,13 +17,13 @@ jobs:
       PR-BENCH: ${{ steps.benchmark-pr.outputs.BENCH_RESULT }}
       MAIN-BENCH: ${{ steps.benchmark-main.outputs.BENCH_RESULT }}
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           persist-credentials: false
           ref: ${{github.event.pull_request.head.sha}}
           repository: ${{github.event.pull_request.head.repo.full_name}}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           check-latest: true
           node-version: 20
@@ -43,7 +43,7 @@ jobs:
           echo "::set-output name=BENCH_RESULT::$content"
 
       # main benchmark
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           ref: 'main'
           persist-credentials: false
@@ -70,7 +70,7 @@ jobs:
       pull-requests: write
     steps:
       - name: Comment PR
-        uses: thollander/actions-comment-pull-request@v3
+        uses: thollander/actions-comment-pull-request@65f9e5c9a1f2cd378bd74b2e057c9736982a8e74 # v3.0.1
         with:
           github-token: ${{ secrets.GITHUB_TOKEN }}
           message: |
@@ -83,7 +83,7 @@ jobs:
             ${{ needs.benchmark.outputs.MAIN-BENCH }}
             ```
 
-      - uses: actions-ecosystem/action-remove-labels@v1
+      - uses: actions-ecosystem/action-remove-labels@2ce5d41b4b6aa8503e285553f75ed56e0a40bae0 # v1.3.0
         with:
           labels: |
             benchmark