CI: Pin GitHub actions to full length commit SHA

[jamesobutler]

GitHub's security hardening guide recommends this mitigation method. https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions

This was originally warned by SonarQubeCloud at https://github.com/ImagingDataCommons/dicomweb-client/runs/55258424344 as part of my PR #120.

I have issued this PR to pull out this individual commit to see if the unit tests can pass currently as this CI commit wouldn't actually impact the unit tests. This would be most similar to triggering run_unit_tests.yml from a workflow dispatch for latest commit on the master branch.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[CPBridge]

Looks good to me

[jamesobutler]

@CPBridge Are you able to trigger the run_unit_tests.yml workflow with this PR? That's what I was hoping to see here in terms of whether the CI tests are passing for latest master.

[jamesobutler]

I was unable to approve the workflow since I only have Triage access on this repo. Only maintainers could approve the full workflow.

[CPBridge]

@jamesobutler yes it ran and passed, you can see the results (green tick) on the main page of the repo now: https://github.com/ImagingDataCommons/dicomweb-client/

[fedorov]

@CPBridge @jamesobutler the python tests didn't seem to run. Is this a regression?

[fedorov]

Compare that with #122

[jamesobutler]

@fedorov I think this PR may have been integrated without approving the unit tests workflows to run (since I don't have maintainer role). Integration would have been allowed because the unit tests aren't listed as required status checks for integration into the master branch. You could technically integrate a PR with failing CI due to lack of branch protection rules.

[fedorov]

since I don't have maintainer role

now you do! ;-)