Bump and pin github actions' dependencies

[pjbgf]

What type of PR is this?

/kind cleanup

What this PR does

• Bump all github actions to their latest released version, whilst also pinned them against the specific git commit id.
• Update all job's images to latest (ubuntu-20.04 or macos-11) also pinning them. Some jobs were kept using macos-10.15 due to a dependency to vagrant, which is currently not available on macos-11 (xref Add VirtualBox and Vagrant for macOS Big Sur instances actions/runner-images#2999).

Why we need it:

Pinned dependencies reduce several security risks:

• They ensure that checking and deployment are all done with the same software, reducing deployment risks, simplifying debugging, and enabling reproducibility.
• They can help mitigate compromised dependencies from undermining the security of the project (in the case where you've evaluated the pinned dependency, you are confident it's not compromised, and a later version is released that is compromised).
• They are one way to counter dependency confusion (aka substitution) attacks, in which an application uses multiple feeds to acquire software packages (a "hybrid configuration"), and attackers fool the user into using a malicious package via a feed that was not expected for that package.

More information refer to ossf

Which issue(s) this PR fixes:

Partially fixes #653
Relates to #725

Does this PR have test?

N/A

Special notes for your reviewer:

Running the latest version of buildah on ubuntu-18.04 led to the error: "fuse-overlayfs" is not found. Hence why the motivation of doing both changes together.

Does this PR introduce a user-facing change?

NONE

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[codecov-commenter]

Codecov Report

Merging #738 (77e16ff) into main (c2c7fcf) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main     #738   +/-   ##
=======================================
  Coverage   53.94%   53.94%           
=======================================
  Files          41       41           
  Lines        4121     4121           
=======================================
  Hits         2223     2223           
  Misses       1831     1831           
  Partials       67       67           

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

Looking into the test failure as it is not the usual flake test - potentially this PR will require further changes.

/hold

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[k8s-ci-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: pjbgf, saschagrunert

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [pjbgf,saschagrunert]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

/test pull-security-profiles-operator-test-e2e

[pjbgf]

/unhold