ci: pinar GitHub Actions por SHA (supply-chain)

Svalinn/semgrep github-actions-mutable-action-tag: `uses: owner/acao@vN`
segue uma tag MUTAVEL — quem controla a tag troca o codigo que roda no
nosso runner, com acesso aos secrets do job. Trocado por SHA de commit
com a tag preservada em comentario ao lado.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

Author: claude

.github/workflows/ci.yml

@@ -14,8 +14,8 @@ jobs:
   test:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
+      - uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5
         with:
           python-version: "3.13"
       - name: Install pinned dependencies