ci: pin security workflow Actions to full commit SHAs

Author: PsiACE

.github/workflows/landing-bump.yml

@@ -71,7 +71,7 @@ jobs:
       GIT_COMMITTER_EMAIL: ${{ vars.LANDING_GIT_EMAIL || '41898282+github-actions[bot]@users.noreply.github.com' }}
     steps:
       - name: Check out trusted default branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           ref: ${{ github.event.repository.default_branch }}
           fetch-depth: 0
@@ -86,7 +86,7 @@ jobs:
         if: github.event_name == 'workflow_run' && startsWith(github.event.workflow_run.head_branch, 'deps/landing-')
         run: echo "LANDING_PUBLISHING_ACTOR=$(gh api graphql -f query='{viewer{login}}' --jq .data.viewer.login)" >> "$GITHUB_ENV"
       - name: Remediate vulnerable dependencies
-        uses: bubbuild/landing@main
+        uses: bubbuild/landing@9014baa64f82893dc194a3f1e31391737f68c426
         env:
           LANDING_MODEL: ${{ vars.LANDING_MODEL }}
           LANDING_API_KEY: ${{ secrets.LANDING_API_KEY }}