.github/workflows: pin GitHub action versions (#631)

Pin versions of GitHub actions that are used in our workflows.

Bumps an instance of actions/checkout from v3.x to v4.x.

Bumps actions/setup-java from v3.x to v4.x.

Updates #cleanup

Signed-off-by: Mario Minardi <mario@tailscale.com>

.github/workflows/android.yml

@@ -16,12 +16,12 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v3
-      - uses: actions/setup-go@v5
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           go-version-file: "go.mod"
       - name: Switch to Java 17 # Note: 17 is pre-installed on ubuntu-latest
-        uses: actions/setup-java@v3
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
           distribution: "temurin"
           java-version: "17"

.github/workflows/go_mod_tidy.yml

@@ -19,10 +19,10 @@ jobs:
 
     steps:
       - name: Check out code
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Set up Go
-        uses: actions/setup-go@v5
+        uses: actions/setup-go@0aaccfd150d50ccaeb58ebd88d36e91967a5f35b # v5.4.0
         with:
           cache: false
           go-version-file: go.mod

.github/workflows/license-headers.yml

@@ -14,6 +14,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: check license headers
         run: ./scripts/check_license_headers.sh .