fix: pin bot token setup to a commit hash

Author: gagik

.github/workflows/bump-auxiliary-packages.yml

@@ -10,7 +10,7 @@ jobs:
     name: Bump packages
     runs-on: ubuntu-latest
     steps:
-      - uses: mongodb-js/devtools-shared/actions/setup-bot-token@main
+      - uses: mongodb-js/devtools-shared/actions/setup-bot-token@d638357cabd624ae626d9abb62cbac2760aea932
         id: app-token
         with:
           app-id: ${{ vars.DEVTOOLS_BOT_APP_ID }}