ci: fixa actions de terceiros em commit SHA (#16)

O CodeQL apontava nove alertas actions/unpinned-tag: actions de
terceiros referenciadas por tag mutavel, que pode ser reapontada para
outro commit a qualquer momento.

Cada uma passa a ser referenciada pelo SHA, com a versao em comentario
para o Dependabot continuar atualizando.

Duas refs carregavam semantica alem da versao e precisaram de ajuste:

- dtolnay/rust-toolchain@stable: a branch stable era o que selecionava
  a toolchain. Agora o SHA e o de master e a selecao vem de
  `toolchain: stable`.
- taiki-e/install-action@cargo-llvm-cov: a tag nomeava a ferramenta,
  que passa para `tool: cargo-llvm-cov`.

Author: NullSablex

.github/workflows/release.yml

@@ -35,8 +35,9 @@ jobs:
           fi
 
       - name: Install Rust
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           targets: i686-unknown-linux-gnu,i686-pc-windows-msvc
 
       - name: Install cross-compilation tools
@@ -116,7 +117,7 @@ jobs:
           cat release_body.md
 
       - name: Upload release assets
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
         with:
           body_path: release_body.md
           append_body: true

.github/workflows/rust.yml

@@ -23,8 +23,9 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install Rust (stable + clippy)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           targets: i686-unknown-linux-gnu
           components: clippy
 
@@ -33,7 +34,7 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-multilib g++-multilib
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Build
         run: cargo build --target i686-unknown-linux-gnu --verbose
@@ -52,8 +53,9 @@ jobs:
     steps:
       - uses: actions/checkout@v7
       - name: Install Rust (stable + rustfmt)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           components: rustfmt
       - run: cargo fmt --all -- --check
 
@@ -69,7 +71,7 @@ jobs:
       checks: write
     steps:
       - uses: actions/checkout@v7
-      - uses: rustsec/audit-check@v2
+      - uses: rustsec/audit-check@69366f33c96575abad1ee0dba8212993eecbe998 # v2.0.0
         with:
           token: ${{ secrets.GITHUB_TOKEN }}
 
@@ -82,8 +84,9 @@ jobs:
       - uses: actions/checkout@v7
 
       - name: Install Rust (stable + llvm-tools)
-        uses: dtolnay/rust-toolchain@stable
+        uses: dtolnay/rust-toolchain@02cb101ec7c40f2c49e1d9714d64511d8e1b74de # v1
         with:
+          toolchain: stable
           targets: i686-unknown-linux-gnu
           components: llvm-tools-preview
 
@@ -92,10 +95,12 @@ jobs:
           sudo apt-get update
           sudo apt-get install -y gcc-multilib g++-multilib
 
-      - uses: Swatinem/rust-cache@v2
+      - uses: Swatinem/rust-cache@6323deb102c322ba6fcbdcafc7e3dddab59af2b6 # v2.9.2
 
       - name: Install cargo-llvm-cov
-        uses: taiki-e/install-action@cargo-llvm-cov
+        uses: taiki-e/install-action@94c31af3204a9f15ab40b35ad084410b905bbc73 # v2.87.17
+        with:
+          tool: cargo-llvm-cov
 
       - name: Generate LCOV report
         run: cargo llvm-cov --target i686-unknown-linux-gnu --lcov --output-path lcov.info