feat: hash script for github actions (#4991)

<!--
Title (for the Pull Request title field at the top):
Use a short prefix so the change type is obvious. You do not need to
repeat it in the body below.

Examples:
- fix: — bugfix
- feat: — feature
- refactor: — internal change without user-facing feature
- docs: — documentation only
- chore: — tooling, CI, deps, build housekeeping
- test: — tests only
-->

## Linked issue (required)

<!-- Fixes #123 / Closes #123 / Refs #123 -->
What I used to complete #4916

## Summary / motivation (required)

<!-- What this PR does and why. For larger changes, add enough context
for reviewers. -->
If we need to add more github actions in future this should make it easy

---------

Co-authored-by: Abdo <abdo@abdnh.net>

tools/github-action-version-to-hash.sh

@@ -0,0 +1,24 @@
+#!/bin/bash
+# Replace version tags with commit hashes in github actions workflows
+# Example: "uses: actions/checkout@v4"
+# -> "uses: actions/checkout@11bd...683 #v4"
+
+shopt -s globstar
+
+for workflow in .github/**/*.yml; do
+    grep -E "uses:[[:space:]]+[A-Za-z0-9._-]+/[A-Za-z0-9._-]+(/[A-Za-z0-9._-]+)*@v[0-9]+" "$workflow" |
+    while read -r line; do
+        action=$(echo "$line" | sed -E 's/.*uses:[[:space:]]+([^[:space:]#]+)@v[0-9]+.*/\1/')
+        repo=$(echo "$action" | cut -d/ -f1,2)
+        tag=$(echo "$line" | sed -E 's/.*@(v[0-9]+).*/\1/')
+
+        commit_hash=$(git ls-remote "https://github.com/$repo.git" "refs/tags/$tag" | cut -f1)
+
+        if [ -n "$commit_hash" ]; then
+            sed -i.bak -E \
+                "s|(uses:[[:space:]]+$action@)$tag|\1$commit_hash #$tag|g" \
+                "$workflow"
+            rm -f "$workflow.bak"
+        fi
+    done
+done