feat(ci): use sha instead of tag on steps

[tobiasehlert]

This pull request updates several GitHub Actions in workflow files to use explicit commit SHAs for each action, rather than floating version tags. This change improves security and reliability by ensuring the workflows always use the intended action versions, preventing unexpected updates or breaking changes.

closes #48

[Copilot]

Pull Request Overview

This pull request enhances security by pinning GitHub Actions to specific commit SHAs instead of using floating version tags. This prevents potential supply chain attacks and ensures reproducible builds by locking actions to known, verified versions.

• Replaced all floating version tags (e.g., @v4, @v5.6.0) with commit SHAs and version comments
• Updated actions across three workflow files: test, release, and bump workflows
• Maintained existing functionality while improving security posture

Reviewed Changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated no comments.

File	Description
.github/workflows/test.yaml	Updated 5 actions to use commit SHAs for testing workflow
.github/workflows/release.yaml	Updated 5 actions to use commit SHAs for release workflow
.github/workflows/bump.yaml	Updated 3 actions to use commit SHAs for version bump workflow

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}