Pin non-GitHub actions with full sha in workflows (#124)

Signed-off-by: kingthorin <kingthorin@users.noreply.github.com>

Author: kingthorin

.github/workflows/release.yml

@@ -24,4 +24,4 @@ jobs:
         pipx install poetry==1.8.0
         poetry build
     - name: Publish package distributions to PyPI
-      uses: pypa/gh-action-pypi-publish@release/v1
+      uses: pypa/gh-action-pypi-publish@67339c736fd9354cd4f8cb0b744f2b82a74b5c70 # v1.12.3