ci: Pin GitHub Actions to specific commit SHAs

Replace version tags with commit SHAs for actions/checkout@v4 and purcell/setup-emacs@master to improve supply chain security and ensure reproducible builds.

Author: rhblind

.github/workflows/test.yml

@@ -20,10 +20,10 @@ jobs:
           - "snapshot"
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Emacs ${{ matrix.emacs_version }}
-        uses: purcell/setup-emacs@master
+        uses: purcell/setup-emacs@bdc64dc730ae1fcba200bfd52cb1b4cf6159cbe5 # v8.0
         with:
           version: ${{ matrix.emacs_version }}
 
@@ -46,10 +46,10 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
 
       - name: Set up Emacs 29.1
-        uses: purcell/setup-emacs@master
+        uses: purcell/setup-emacs@bdc64dc730ae1fcba200bfd52cb1b4cf6159cbe5 # v8.0
         with:
           version: "29.1"