Be stricter about version SHAs of external actions (#167)
Be stricter about version SHAs of external actions (#167)

This will prevent any possibility of a supply-chain vulnerability: even
if one of those projects gets taken over by a hostile maintainer, they
can't change the existing commit SHAs. So barring a SHA collision, we
will always be running known-good versions of these actions.
sillsdev/LfMerge,sillsdev/LfMerge,sillsdev/LfMerge