Pin actions to exact version numbers

With renovate automatically updating versions we can use exact version
numbers alongside pinned hashes. This ensures that renovate will
quietly merge minor and patch versions, creating pull requests for
major versions and hopefully never notify us about digest changes.

Author: mpkorstanje

.github/workflows/test-java.yml

@@ -20,8 +20,8 @@ jobs:
     name: 'Build Java ${{ matrix.version }} - ${{ matrix.os }}'
     runs-on: ${{ matrix.os }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
-      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.version }}