ci: pin a GitHub action to protect against supply chain attacks

[Arthur1]

To reduce the risk of supply chain attacks, pinning action dependencies using SHA is recommended.

Pinning an action to a full-length commit SHA is currently the only way to use an action as an immutable release. Pinning to a particular SHA helps mitigate the risk of a bad actor adding a backdoor to the action's repository, as they would need to generate a SHA-1 collision for a valid Git object payload.

https://docs.github.com/en/enterprise-cloud@latest/actions/reference/security/secure-use#using-third-party-actions

Additionally, if SHA pinning enforcement setting is enabled, workflows using ent/contrib/ci will not function. This is because the system recursively checks whether composite actions are pinned.

This pull request addresses these issues by pinning actions/github-script action.