chore: pin GitHub Actions to full-length commit SHAs

[joshuarli]

Summary

• Pin all GitHub Actions references in .github/ workflow files to full-length commit SHAs

Generated by devenv pin_gha.

🤖 Generated with Claude Code

[github-actions]

Changelog Preview

📋 Changelog Preview

This is how your changes will appear in the changelog.
Entries from this PR are highlighted with a left border (blockquote style).

---

New Features ✨

• Remove 'vroom-cleanup' container by aldy505 in #4217

Internal Changes 🔧

Deps

• Bump getsentry/craft from 2.23.2 to 2.24.1 by dependabot in #4221
• Bump astral-sh/setup-uv from 7.2.1 to 7.5.0 by dependabot in #4220

Other

• Pin GitHub Actions to full-length commit SHAs by joshuarli in #4239

---

_{🤖 This preview updates automatically when you update the PR.}

[BYK]

changelog preview should stay on the tag

[BYK]

Suggested change

	uses: getsentry/craft/.github/workflows/changelog-preview.yml@f4889d04564e47311038ecb6b910fef6b6cf1363 # v2
	uses: getsentry/craft/.github/workflows/changelog-preview.yml@v2

[BYK]

It's also a bit silly to pin this to a SHA. We should lock down its permissions instead.

[aminvakil]

Why not do both?

[aldy505]

@aminvakil FYI internally, there is a Slack thread that's disagreeing on this whole GitHub Actions pinning organization-wide, specifically for actions from getsentry org. @BYK argues that he finds it okay with pinning actions made by external parties other than getsentry and actions github org.

I agree with what Burak said and want to change that for self-hosted. Majority of it because of noisy Dependabot PRs. Here's the Slack convo AI summary for the thread:

[aldy505]

I'll drop this PR in 8 hours...

[aminvakil]

Gotcha.