ci: pin the PyPI publish action to a commit

A third-party action with the right to publish should be an immutable
reference.  dependabot (github-actions, monthly) keeps it current.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Author: petercorke

.github/workflows/publish.yml

@@ -109,6 +109,7 @@ jobs:
           name: dist
           path: dist
 
-      - uses: pypa/gh-action-pypi-publish@release/v1
+      # pinned to a commit, as this action can publish to PyPI; dependabot updates it
+      - uses: pypa/gh-action-pypi-publish@dc37677b2e1c63e2034f94d8a5b11f265b73ba33  # v1.14.2
         with:
           skip_existing: true