chore(github-actions): pin dependencies (#79)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/build.yml

@@ -37,14 +37,14 @@ jobs:
     steps:
       # Full history and tags: git-dyn-semver derives the version from git state, so a
       # shallow clone would build the wrong number rather than fail.
-      - uses: actions/checkout@v7
+      - uses: actions/checkout@v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
           fetch-tags: true
           ref: ${{ inputs.ref || github.ref }}
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v5.7.0
         with:
           java-version: "21"
           distribution: "temurin"