Pin GitHub Action references to commit SHAs

[thpierce]

Summary

Pin all GitHub Action references to full commit SHAs instead of mutable version tags to prevent supply chain attacks. This is a security best practice recommended by GitHub's security hardening guide.

Mutable version tags (e.g. @v2) can be moved to point to different commits, meaning a compromised upstream action could execute malicious code in our workflows. Pinning to commit SHAs ensures we always run the exact code we've reviewed.

Changes

Old Reference	New Reference	Hash	Version
actions/cache@v3	actions/cache@6f8efc2	6f8efc29b200d32929f49075959781ed54ec270c	v3.5.0
actions/checkout@v3	actions/checkout@f43a0e5	f43a0e5ff2bd294095638e18286ca9a3d1956744	v3.6.0
aws-actions/configure-aws-credentials@v1	aws-actions/configure-aws-credentials@67fbcbb	67fbcbb121271f7775d2e7715933280b06314838	v1.7.0
docker/login-action@v2	docker/login-action@465a078	465a07811f14bebb1938fbed4728c6a1ff8901fc	v2.2.0
docker/setup-buildx-action@v1	docker/setup-buildx-action@f211e3e	f211e3e9ded2d9377c8cadc4489a4e38014bc4c9	v1.7.0

Static Code Check

Added a static-code-checks job to pr-build.yml that will fail PRs introducing mutable GitHub Action version references.