fix(security): autofix 3rd party Github Actions should be pinned

Author: aikido-autofix[bot]

.github/workflows/ci.yml

@@ -20,7 +20,7 @@ jobs:
       uses: actions/checkout@v4
 
     - name: Setup PHP
-      uses: shivammathur/setup-php@v2
+      uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
       with:
         php-version: ${{ matrix.php-version }}
         coverage: none