security: pin GitHub Actions to full commit SHA and bump to latest versions

[mugioka]

Problem

All GitHub Actions in .github/workflows/ci.yaml are referenced by mutable tags
(e.g. actions/checkout@v5). If a tag is silently moved to a malicious commit,
arbitrary code runs in our CI pipeline with id-token: write and packages: write
permissions.

Ref: GitHub security hardening guide — Using third-party actions

Changes

Replace each tag reference with the full commit SHA of the latest release, and
keep the version as an inline comment:

Action	Current	Latest
actions/checkout	@v5	@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
docker/setup-qemu-action	@v3	@06116385d9baf250c9f4dcb4858b16962ea869c3 # v4.1.0
docker/setup-buildx-action	@v3	@d7f5e7f509e45cec5c76c4d5afdd7de93d0b3df5 # v4.1.0
docker/login-action	@v3	@650006c6eb7dba73a995cc03b0b2d7f5ca915bee # v4.2.0
docker/metadata-action	@v5	@80c7e94dd9b9319bd5eb7a0e0fe9291e23a2a2e9 # v6.1.0
docker/build-push-action	@v6	@f9f3042f7e2789586610d6e8b85c8f03e5195baf # v7.2.0