chore(deps): pin dependencies (#664)

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>

Author: renovate[bot]

.github/workflows/build.yml

@@ -349,7 +349,7 @@ jobs:
           merge-multiple: true
       - name: Run Trivy vulnerability scanner
         if: ${{ github.event_name == 'pull_request' }}
-        uses: aquasecurity/[email protected]
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
         with:
           input: "images/${{ matrix.image }}.tar"
           format: "sarif"
@@ -364,15 +364,15 @@ jobs:
           password: ${{ secrets.GITHUB_TOKEN }}
       - name: Run Trivy vulnerability scanner
         if: ${{ github.event_name != 'pull_request' }}
-        uses: aquasecurity/[email protected]
+        uses: aquasecurity/trivy-action@b6643a29fecd7f34b3597bc6acb0a98b03d33ff8 # 0.33.1
         with:
           image-ref: "ghcr.io/jeboehm/${{ matrix.image }}:latest"
           format: "sarif"
           output: "trivy-results.sarif"
           severity: "CRITICAL,HIGH"
       - name: Upload Trivy scan results to GitHub Security tab
         if: always()
-        uses: github/codeql-action/upload-sarif@v4
+        uses: github/codeql-action/upload-sarif@cdefb33c0f6224e58673d9004f47f7cb3e328b89 # v4
         with:
           sarif_file: "trivy-results.sarif"
           category: "${{ matrix.image }}"