Pin GitHub Actions to SHAs [SRE-1802]

[tylergohl]

Summary

Pin GitHub Actions references in this repo to immutable commit SHAs (with the original tag/branch preserved in a trailing comment).

Scope

This PR pins:

• Internal ctrliq/* reusable workflow and action references
• External actions

Files touched

• .github/workflows/build.yml

Test plan

• Workflow runs succeed on this branch (or on next trigger after merge)
• Once this and any companion clo-ciq PR merge, this repo has zero unpinned external/internal refs and sha_pinning_required can be enabled on it

[ciq-it-service-account]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[Copilot]

Pull request overview

This PR hardens the CI supply chain by pinning GitHub Actions used in the repository’s workflow to immutable commit SHAs (per SRE-1802), reducing the risk of upstream tag changes affecting builds.

Changes:

• Pin actions/setup-java references to a specific commit SHA (with v5 noted in comments).
• Pin ncipollo/release-action to a specific commit SHA (with v1 noted in comments).

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[wresch]

LGTM