Use commit SHAs for third-party actions to ensure that the same versions are always being downloaded.