[LOW] Pin test workflow actions to immutable commits

[OskarEichler]

Summary

• pin every third-party action in the test workflow to the immutable commit currently referenced by its version tag
• retain version comments so Dependabot and reviewers can identify the selected releases
• keep the workflow's existing read-only contents permission unchanged

Mutable action tags can be moved after review, causing future workflow runs to execute code that was not part of the reviewed revision. This change preserves the current action versions while making the executed revisions deterministic.

Verification

• resolved each commit directly from the upstream action repository (actions/checkout v6, ruby/setup-ruby v1, and supercharge/mongodb-github-action 1.12.1; the annotated MongoDB tag was dereferenced to its commit)
• parsed .github/workflows/test.yml with Ruby's YAML parser
• full Active Record suite: 878 runs, 2,470 assertions, 0 failures
• gem build passes
• git diff --check passes

Limitations

• Dependabot PR Bump actions/checkout from 6 to 7 #5852 separately proposes upgrading actions/checkout from v6 to v7. This PR intentionally avoids bundling that version upgrade; after Bump actions/checkout from 6 to 7 #5852 lands, its v7 reference should likewise be pinned to the reviewed v7 commit.

Compatibility

• no runtime, gem dependency, or public API changes
• no breaking changes expected
• no test files changed

Prepared with Codex assistance.