chore(ci): pin all GitHub Actions to commit SHAs

[coderabbitai]

Summary

All GitHub Actions in .github/workflows/ci.yml are currently referenced by mutable version tags (e.g., @v1, @v4, @stable). These tags can be silently re-pointed to a different (potentially malicious) commit, creating a supply-chain attack surface. Pinning each action to a full commit SHA makes the referenced code immutable.

Actions to pin

At minimum, the following actions used in .github/workflows/ci.yml should be pinned to their current commit SHAs:

• actions/checkout
• actions/cache
• actions/upload-artifact
• actions/download-artifact
• actions/setup-node
• dtolnay/rust-toolchain
• pnpm/action-setup
• foundry-rs/foundry-toolchain
• noir-lang/noirup
• browser-actions/setup-chrome
• docker/setup-buildx-action
• docker/login-action
• docker/build-push-action
• dorny/paths-filter
• cachix/install-nix-action
• akhilmhdh/contributors-readme-action

References

• Raised in PR: refactor: adapt to fhe.rs upstream [skip-line-limit] #1561 (comment)
• Tools like Dependabot or pin-github-action can automate the pinning and keep SHAs up to date.

/cc @0xjei