[P3] SHA-pin the safe-settings checkout ref

## Why
Git tags are mutable. Pinning to a commit SHA guarantees the exact code run.

```bash
git ls-remote https://github.com/github/safe-settings refs/tags/2.1.19
```

Best done at the same time as the 2.1.19 upgrade.

_Audit report — section 2a_