Semgrep flagged two mutable tags on mongodb-client-encryption#137; I deferred both with `/other` pointing here.

Use Case

As a maintainer of the Node packages
I want every `uses:` reference pinned to an immutable commit SHA
So a repointed upstream tag cannot change what runs in our release jobs without a diff in our repos.

`vN` tags move by design on every patch, and that same git write is the attack primitive (trivy-action, kics-github-action, tj-actions/changed-files CVE-2025-30066).

User Experience

• n/a, CI and release infrastructure only

Dependencies

• DRIVERS-3601 gives `drivers-github-tools` immutable version tags

Risks/Unknowns

• Make sure Dependabot tracks pinned versions
• Semgrep only comments on lines a PR touches

Acceptance Criteria

Implementation Requirements

• In each repo, pin every uses: reference to a full 40-character commit SHA, with the version kept as a trailing comment, for example uses: actions/checkout@8ade135a41bc03ea155e62e844d188df1ea18608 # v6
• Cover all workflows, including release, CodeQL and any reusable or composite actions defined in the repo
• Confirm dependabot is configured to update pinned SHAs in each repo

Testing Requirements

• All workflows pass in each repo after pinning
• No github-actions-mutable-action-tag findings on subsequent PRs

Follow Up Requirements

• Re-check the `drivers-github-tools` references once DRIVERS-3601 lands