fix: pin GitHub Actions to commit SHAs for CI hardening

- actions/checkout v4.3.1 (34e11487)
- actions/setup-java v4.8.0 (c1e32368)
- amondnet/vercel-action v25.2.0 (16e87c0a)

Ref: SELF-2469

Author: jcortejoso

.github/workflows/publish-android-sdk.yml

@@ -25,9 +25,9 @@ jobs:
       run:
         working-directory: packages/native-shell-android
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
-      - uses: actions/setup-java@v4
+      - uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # v4.8.0
         with:
           distribution: temurin
           java-version: '17'

.github/workflows/webview-deploy.yml

@@ -19,7 +19,7 @@ jobs:
     name: Deploy to Vercel
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1
 
       - uses: ./.github/actions/yarn-install
 
@@ -33,7 +33,7 @@ jobs:
         run: yarn workspace @selfxyz/webview-app build:hosted
 
       - name: Deploy to Vercel
-        uses: amondnet/vercel-action@v25
+        uses: amondnet/vercel-action@16e87c0a08142b0d0d33b76aeaf20823c381b9b9 # v25.2.0
         with:
           vercel-token: ${{ secrets.VERCEL_TOKEN }}
           vercel-org-id: ${{ secrets.VERCEL_ORG_ID }}