ci: pin hashes for downstream actions (#4860)
ci: pin hashes for downstream actions (#4860)

Summary:
GitHub appear to have set a convention that it’s okay for action
maintainers to force-push tags. This is unacceptable, because it makes
our builds non-hermetic and complicates the security story. This patch
pins all the tags to their current object hashes. Much less readable,
but our hand is forced.

Generated manually, but I verified that this gives the same results as
applying the shell script generated by the following cozy one-liner:

```
git show @~:.github/workflows/ci.yml | grep -Eo '([^/ ]+/[^@]+)@v.*' | sort -u | while IFS=@ read repo v; do sha="$(curl -fsSL "https://api.github.com/repos/$repo/tags" | jq --arg name "$v" '.[]|select(.name == $name)|.commit.sha' -r)"; printf 's#%s@%s#%s@%s#g\n' "$repo" "$v" "$repo" "$sha"; done
```

Namely, the substitutions are:

```
s#actions/cache@v2#actions/cache@1a9e2138d905efd099035b49d8b7a3888c653ca8#g
s#actions/checkout@v1#actions/checkout@50fbc622fc4ef5163becd7fab6573eac35f8462e#g
s#actions-rs/clippy-check@v1#actions-rs/clippy-check@b5b5f21f4797c02da247df37026fcd0a5024aa4d#g
s#actions-rs/toolchain@v1#actions-rs/toolchain@16499b5e05bf2e26879000db0c1d13f7e13fa3af#g
s#actions/setup-node@v1#actions/setup-node@56899e050abffc08c2b3b61f3ec6a79a9dc3223d#g
s#actions/setup-python@v1#actions/setup-python@152ba7c4dd6521b8e9c93f72d362ce03bf6c4f20#g
s#actions/upload-artifact@v2#actions/upload-artifact@ee69f02b3dfdecd58bb31b4d133da38ba6fe3700#g
s#DoozyX/clang-format-lint-action@v0.5#DoozyX/clang-format-lint-action@0138140a2adaafd3032a3ff37f66366fd7dc88e0#g
```

Test Plan:
`grep @v .github/workflows/ci.yml` has no matches.

wchargin-branch: ci-pin-action-hashes

tensorflow/tensorboard,tensorflow/tensorboard,tensorflow/tensorboard,tensorflow/tensorboard,tensorflow/tensorboard,tensorflow/tensorboard,tensorflow/tensorboard