Pin GitHub Actions to immutable SHAs to prevent supply-chain tag hijacks | saasbrowser.ai