Replace all external github action runner tags with hashes

[sirbrillig]

This PR pins all GitHub Actions action runners to full commit SHAs rather than mutable version tags. This protects against supply chain attacks where a compromised action author could push malicious code under an existing tag (e.g. v2) and have it silently execute in CI with access to repository tokens.

Each pinned SHA has the corresponding version tag noted in a comment for readability.

Actions pinned:

• actions/checkout @ v6
• shivammathur/setup-php @ v2
• ramsey/composer-install @ v3
• coverallsapp/github-action @ v2
• phpcsstandards/xmllint-validate @ v1

[jrfnl]

@sirbrillig Sorry for the confusion, but this PR is not the right way to do this.

The v# branches/tags are moving tags/branches, which I expect will mean that you've now effectively disabled Dependabot.

Would you like me to submit a PR to fix this ?

[sirbrillig]

@jrfnl Oh! Sorry. I misunderstood. My understanding was that Dependabot handled hard-coded branch hashes but I don't have a ton of experience with action runners. Yes, if you have time to submit a PR I'd be happy to accept it, or if it would be easier just let me know what you mean and I can try to implement it.

[jrfnl]

@sirbrillig Simpler to PR it than to explain. See #362