ci: pin all actions to full-length commit SHAs (#36621)

Pin all remaining GitHub Actions references to full-length commit SHAs,
matching the convention already established by third-party actions in
this repo. This is a prerequisite for enabling GitHub's "Require actions
to be pinned to a full-length commit SHA" repository ruleset, which
mitigates tag-hijacking supply chain attacks.

.github/workflows/auto-label-by-package.yml

@@ -15,7 +15,7 @@ jobs:
 
     steps:
       - name: Sync package labels
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8
         with:
           script: |
             const body = context.payload.issue.body || "";