Pin third-party actions to currently used SHA (#1255)

## Description
In light of the [recent compromise of the tj-actions/changed-files
action](https://www.stepsecurity.io/blog/harden-runner-detection-tj-actions-changed-files-action-is-compromised),
we’re trying to reduce the risk incurred from our use of third-party
actions.

[GitHub
documentation](https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
recommends pinning third-party actions to a full length commit SHA as a
good security practice, and as the only way to use an action as an
immutable release.

This PR pins this repository’s third-party actions to their currently
used version’s commit SHA, as indicated in the logs for the most recent
workflow runs, or from the most recent matching release if logs are not
available.

If desired, we can also look into adding a Dependabot configuration to
help keep actions updated by automatically creating update PRs when new
versions are available.

## Documentation

Does this require changes to the WorkOS Docs? E.g. the [API
Reference](https://workos.com/docs/reference) or code snippets need
updates.

```
[ ] Yes
```

If yes, link a related docs PR and add a docs maintainer as a reviewer.
Their approval is required.

Author: nickcollisson-workos

.github/workflows/coana-analysis.yml

@@ -20,7 +20,7 @@ jobs:
 
       - name: Run Coana CLI
         id: coana-cli
-        uses: docker://coana/coana:latest
+        uses: docker://coana/coana:latest@sha256:74144ed0fc9d7da87dcd45ccd12458cc7c25ad23e47eebd7ceb4860ed396d63e
         with:
           args: |
             coana run . \