Pin and bump action versions in release workflow too (#239)

Author: di

.github/workflows/release.yml

@@ -1,4 +1,4 @@
-name: Publish to PyPI 
+name: Publish to PyPI
 
 on:
   push:
@@ -13,10 +13,10 @@ jobs:
      permissions:
        id-token: write
      steps:
-       - uses: actions/checkout@v4
-       - uses: actions/setup-python@v5
+       - uses: actions/checkout@1af3b93b6815bc44a9784bd300feb67ff0d1eeb3 # v6.0.0
+       - uses: actions/setup-python@e797f83bcb11b83ae66e0230d6156d7c80228e7c # v6.0.0
          with:
-           python-version: '3.11' 
+           python-version: '3.11'
        - name: Install pypa/build
          run: >-
            python3 -m