chore: pin third-party GitHub Actions to commit SHAs

[mahangu]

Pins third-party GitHub Actions in Newspack workspace workflows to immutable commit SHAs. Dependabot GitHub Actions coverage already exists in this repo, so this PR leaves the Dependabot config unchanged.

Tracking: DEVPROD-1072

Verification commands:

# pnpm/action-setup # v4.3.0 -> b906affcce14559ad1aafd4ab0e942779e9f58b1
gh api repos/pnpm/action-setup/commits/v4.3.0 --jq '.sha'
# expected: b906affcce14559ad1aafd4ab0e942779e9f58b1

# shivammathur/setup-php # 2.37.1 -> 7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc
gh api repos/shivammathur/setup-php/commits/2.37.1 --jq '.sha'
# expected: 7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc

# dependabot/fetch-metadata # v2.5.0 -> 21025c705c08248db411dc16f3619e6b5f9ea21a
gh api repos/dependabot/fetch-metadata/commits/v2.5.0 --jq '.sha'
# expected: 21025c705c08248db411dc16f3619e6b5f9ea21a

# thollander/actions-comment-pull-request # v3.0.1 -> 24bffb9b452ba05a4f3f77933840a6a841d1b32b
gh api repos/thollander/actions-comment-pull-request/commits/v3.0.1 --jq '.sha'
# expected: 24bffb9b452ba05a4f3f77933840a6a841d1b32b

[github-actions]

Hey @mahangu, good job getting this PR merged! 🎉

Now, the needs-changelog label has been added to it.

Please check if this PR needs to be included in the "Upcoming Changes" and "Release Notes" doc. If it doesn't, simply remove the label.

If it does, please add an entry to our shared document, with screenshots and testing instructions if applicable, then remove the label.

Thank you! ❤️

[Copilot]

Pull request overview

This PR hardens the repository’s GitHub Actions security posture by pinning third-party actions used in workspace workflows to immutable commit SHAs (while keeping Dependabot GitHub Actions updates in place).

Changes:

• Pin pnpm/action-setup usages to b906affcce14559ad1aafd4ab0e942779e9f58b1 (v4.3.0).
• Pin shivammathur/setup-php usages to 7c071dfe9dc99bdf297fa79cb49ea005b9fcadbc (2.37.1).
• Pin dependabot/fetch-metadata and thollander/actions-comment-pull-request to their respective commit SHAs.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
.github/workflows/sync-legacy.yml	Pins pnpm/action-setup to a commit SHA for the legacy sync workflow.
.github/workflows/release.yml	Pins pnpm/action-setup and shivammathur/setup-php to commit SHAs for release automation.
.github/workflows/publish-baseline-releases.yml	Pins pnpm/action-setup and shivammathur/setup-php to commit SHAs for baseline release publishing.
.github/workflows/ci.yml	Pins pnpm/action-setup and shivammathur/setup-php to commit SHAs across CI jobs.
.github/workflows/changelog.yml	Pins thollander/actions-comment-pull-request to a commit SHA for PR commenting.
.github/workflows/auto-merge.yml	Pins dependabot/fetch-metadata to a commit SHA for Dependabot automerge.
.github/workflows/_release-wporg.yml	Pins pnpm/action-setup and shivammathur/setup-php to commit SHAs for WP.org deployment.