chore: Lock the versions of GitHub Actions used in workflows to SHA hashes, other security improvements

[connorshea]

Description

• SHA hashes to prevent compromised GitHub Actions from ever being used, also updated to the latest releases for each.
• Disable the bundler-cache in the release job, to protect against the release job pulling a compromised cache and thus pushing a compromised gem.
• Disable credential persistence in the checkout job, to make sure we can't ship it as part of the packaged artifacts by accident.
• Set a 1 day cooldown on github actions updates, just to be safe and hopefully prevent any update to a malicious version of an action.

These changes were all made using zizmor / manual edits by me.

I'm not sure if this warrants a changelog entry?

Checklist

Before the PR can be merged be sure the following are checked:

• There are tests for the fix or feature added/changed
• A description of the changes and a reference to the PR has been added to CHANGELOG.md. More details in the CONTRIBUTING.md

[anakinj]

I'm not sure if this warrants a changelog entry?

No changelog entry needed for this one