try pinning the go module (#23)

Signed-off-by: Tom Hennen <[email protected]>

Author: TomHennen

actions/vsa_creator/action.yml

@@ -11,7 +11,7 @@ runs:
         go-version: '1.23'
     - id: determine_level
       run: |
-        echo "source_level=$(go run github.com/slsa-framework/slsa-source-poc/sourcetool@main --commit ${{ github.sha }} --owner ${{ github.repository_owner }} --repo ${{ github.event.repository.name }} --branch ${{ github.ref_name }})" >> $GITHUB_OUTPUT
+        echo "source_level=$(go run github.com/slsa-framework/slsa-source-poc/sourcetool@585725b99aac94862a6f364ba3a42ae9a9ddcf36 --commit ${{ github.sha }} --owner ${{ github.repository_owner }} --repo ${{ github.event.repository.name }} --branch ${{ github.ref_name }})" >> $GITHUB_OUTPUT
       shell: bash
     - id: create_vsa
       # Run the script from the action directory so it has access to the template...