ci: SHA-pin all GitHub Actions in CI workflow

Replace mutable action refs with pinned commit SHAs, per the supply-chain
requirements in the build-lockdown guidance (inc-18715).

The material fix is `snyk/actions/node@master` -> a pinned v1.0.0 commit: a
floating branch ref on a third-party action, executing with SNYK_TOKEN in
scope. Anyone able to move that branch could run arbitrary code in CI with
the token available.

Also pinned, and bumped off the deprecated v2 majors:
  actions/checkout        v2 -> v7.0.1  (3d3c42e)
  actions/setup-node      v2 -> v7.0.0  (8207627)
  codecov/codecov-action  v5 -> v5.5.5  (0fb7174), pinned at current major
  snyk/actions/node   master -> v1.0.0  (9adf32b)

Caveat: snyk/actions/node is a Docker-based action and still pulls the
mutable `docker://snyk/snyk:node` image at runtime, so the SHA pin bounds
the action code but not the scanner image.

fql-ts is a public repo, so it runs on GitHub-hosted runners and is not
subject to the locked-down agent egress wall; no Buildkite migration is
needed here. See PR description.

Author: MichaelGHSeg

.github/workflows/ci.yml

@@ -11,18 +11,23 @@ jobs:
         node-version: [20.10.0]
 
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: Use Node.js ${{ matrix.node-version }}
-        uses: actions/setup-node@v2
+        uses: actions/setup-node@820762786026740c76f36085b0efc47a31fe5020 # v7.0.0
         with:
           node-version: ${{ matrix.node-version }}
 
       - name: Install Dependencies
         run: yarn install --frozen-lockfile
 
       - name: Run Snyk to check for vulnerabilities
-        uses: snyk/actions/node@master
+        # Was `@master` — a mutable branch ref on a third-party action running
+        # with SNYK_TOKEN in scope. Pinned to the v1.0.0 release commit.
+        # NOTE: this action is Docker-based and still pulls the mutable
+        # `docker://snyk/snyk:node` image at runtime, so the SHA pin bounds the
+        # action code but not the scanner image.
+        uses: snyk/actions/node@9adf32b1121593767fc3c057af55b55db032dc04 # v1.0.0
         env:
           SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
         with:
@@ -35,7 +40,7 @@ jobs:
         run: yarn test --coverage
 
       - name: Upload coverage reports to Codecov
-        uses: codecov/codecov-action@v5
+        uses: codecov/codecov-action@0fb7174895f61a3b6b78fc075e0cd60383518dac # v5.5.5
         with:
           token: ${{ secrets.CODECOV_TOKEN }}
           slug: segmentio/fql-ts