security: pin GitHub Actions to full commit SHAs

Pins third-party GitHub Actions (`actions/checkout` and `jdx/mise-action`)
to full immutable commit SHAs in CI workflows (`check.yml` and `docs.yml`).
This mitigates supply chain risks and tag-spoofing vulnerabilities.

Author: google-labs-jules[bot]

.github/workflows/check.yml

@@ -17,8 +17,8 @@ jobs:
           - "3.13"
           - "3.12"
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
         with:
           tool_versions: |
             python ${{ matrix.python-version }}

.github/workflows/docs.yml

@@ -10,8 +10,8 @@ jobs:
   deploy:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v7
-      - uses: jdx/mise-action@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: jdx/mise-action@500809d363d3fb4f307ee44f24ef3381a1792a7e # v2
       - name: Configure Git Credentials
         run: |
           git config user.name github-actions[bot]