build: Pin actions in GitHub Workflows

[ThomasVitale]

Dependabot will update them automatically by also pinning the versions. This will be useful towards complying with the OpenSSF Best Practices

[edeandrea]

Won't this mean that there will be lots and lots more dependabot updates? In all the OSS projects I've worked on, I've never seen this done.

[github-actions]

	Tests	Passed ✅	Skipped	Failed
Gradle Test Results (all modules & JDKs)	324 ran	324 passed	0 skipped	0 failed

Test	Result
No test annotations available

• View Gradle Test Results (all modules & JDKs)

[github-actions]

HTML test reports are available as workflow artifacts (zipped HTML).

• Download: Artifacts for this run

[ThomasVitale]

Yes, there will be more updates, but I can see that Dependabot is configured to automerge PRs if the checks succeed (is that correct?), so it shouldn't result in additional work.

Many projects that follow the OpenSSF security practices pin the dependencies, since it's one of the requirements:

• https://scorecard.dev
• https://openssf.org/best-practices-badge/ (we need to eventually get the Silver badge: Initial architecture & purpose #2 (comment))

Besides security, it protects us from pipelines failing randomly when new minor versions are introduced that might contain unfortunate breaking changes.

Though, I can see the main Docling project doesn't pin dependencies.