ci: SHA-pin actions in update-contributors workflow (#5)

The contributor-update workflow runs with contents: write and a PAT, but
pinned actions/checkout and actions/setup-python to mutable tags (@v4, @v5).
A retag or compromise of either action would run attacker code with write
access to this org-profile repo. Pin both to the full commit SHAs already
trusted in the vyrox python-ci workflow.

Co-authored-by: OM <[email protected]>

Author: keirsalterego

workflows/update-contributors.yml

@@ -15,11 +15,11 @@ jobs:
     permissions:
       contents: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
         with:
           token: ${{ secrets.GH_TOKEN }}
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@0a5c61591373683505ea898e09a3ea4f39ef2b9c # v5.4.0
         with:
           python-version: '3.11'