Pin GitHub Actions to full-length commit SHAs (#329034)

* Pin GitHub Actions to full-length commit SHAs

* chore: attest to third-party action pinning changes

I have reviewed the action-pinning diff authored by OssSecurityBot and
verified that each pinned SHA resolves to the same commit the tag it
replaces pointed at, and that no workflow logic was altered beyond the
`uses:` references.

This commit is signed with my key from security/trusted-signing-keys.csv
so the attestation is bound to my identity and to this exact tree. Any
subsequent push replaces the head and invalidates it.

Refs #328868

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: OssSecurityBot <oss-security-bot@microsoft.com>
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/actions/save-node-modules/action.yml

@@ -15,7 +15,7 @@ runs:
       run: ./.github/workflows/node_modules_cache/cache.ps1 archive
 
     - name: Save node_modules cache
-      uses: actions/cache/save@v5
+      uses: actions/cache/save@caa296126883cff596d87d8935842f9db880ef25 # v5.1.0
       with:
         path: .build/node_modules_cache
         key: ${{ env.NODE_MODULES_CACHE_KEY }}