pin non-verified GH actions

[marandaneto]

Eg https://github.com/getsentry/sentry-java/pull/1440/files#r619501561

worth checking on other non-verified actions too

[bruno-garcia]

Checking if it's verified:

If it's not verified, we have two options; Either fork the action to getsentry/... or pin to the specific commit hash.
Otherwise remove the GHA.

[adinauer]

This might help: https://github.com/sethvargo/ratchet