CI: pin actions by SHA

This eliminates the possibility of a tag being changed under
us.

Author: tacaswell

.github/.github/workflows/publish-pypi.yml

@@ -29,7 +29,7 @@ jobs:
           python setup.py sdist bdist_wheel
 
       - name: Publish mpl-sphinx-theme
-        uses: pypa/gh-action-pypi-publish@master
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4
         with:
           user: __token__
           password: ${{ secrets.pypi_token }}