Say which version the pinned commit actually is

Dependabot moved `ramsey/composer-install` to 4.0.0 and left the comment reading `v3`, which
is the one part of a pinned reference a person can read. A hash nobody can check against a
wrong label is worse than no label.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01ARqBYLxrHqevcVmxHkpJcZ

Author: radek-ziemniewicz

.github/workflows/tests.yml

@@ -23,7 +23,7 @@ jobs:
           php-version: ${{ matrix.php }}
           coverage: none
 
-      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v3
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Unit tests
         run: vendor/bin/unit-tests
@@ -43,7 +43,7 @@ jobs:
           php-version: '8.3'
           coverage: none
 
-      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v3
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: Unit tests with coverage
         run: phpdbg -qrr vendor/bin/unit-tests
@@ -68,7 +68,7 @@ jobs:
           php-version: '8.3'
           coverage: none
 
-      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # v3
+      - uses: ramsey/composer-install@65e4f84970763564f46a70b8a54b90d033b3bdda # 4.0.0
 
       - name: PHPStan
         run: vendor/bin/phpstan analyse --no-progress