fix: use commit SHA for pypa/gh-action-pypi-publish pin

Tag SHA (annotated tag object) doesn't resolve as a Docker image.
Use dereferenced commit SHA instead.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: imran-siddique

.github/workflows/publish.yml

@@ -43,7 +43,7 @@ jobs:
         run: python -m build
 
       - name: Publish ${{ matrix.package }} to PyPI
-        uses: pypa/gh-action-pypi-publish@7f25271a4aa483500f742f9492b2ab5648d61011 # v1.12.4
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           packages-dir: packages/${{ matrix.package }}/dist/
           skip-existing: true