workflows: Pin down action-download-artifact
workflows: Pin down action-download-artifact

`@v2` is a floating tag, and this workflow can access all keys to the
castle. Rather pin down the current commit SHA, which I audited. When we
need to update this, look at the upstream diff between the previous and
new SHA and ensure that this does not do anything sneaky.

mvollmer/cockpit,martinpitt/cockpit,mvollmer/cockpit,garrett/cockpit,mvollmer/cockpit,garrett/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,cockpit-project/cockpit,martinpitt/cockpit,cockpit-project/cockpit,mvollmer/cockpit,garrett/cockpit,martinpitt/cockpit,mvollmer/cockpit,cockpit-project/cockpit,garrett/cockpit,martinpitt/cockpit,martinpitt/cockpit,garrett/cockpit