ci: pin all GitHub Actions to SHA hashes and update versions (#1681)

Update action versions and pin to full SHA commit hashes.
Windows build parallelization is disabled to avoid hung CI.

.github/actions/setup/action.yaml

@@ -4,8 +4,6 @@ description: Install uv, configure the system python, and the package dependenci
 inputs:
   uv-install-options:
     default: ""
-  uv-version:
-    default: 0.9.16
   python-version:
     required: true
   cache-pre-commit:
@@ -17,16 +15,11 @@ runs:
   steps:
     - name: Setup uv
       id: setup-uv
-      uses: astral-sh/setup-uv@v7
+      uses: astral-sh/setup-uv@d31148d669074a8d0a63714ba94f3201e7020bc3 # v8.3.0
       with:
         enable-cache: true
-
-    - name: Setup Python
-      id: setup-python
-      uses: actions/setup-python@v6
-      with:
+        version-file: uv.lock
         python-version: ${{ inputs.python-version }}
-        allow-prereleases: true
 
     - name: Install Project Dependencies
       id: install-project-dependencies
@@ -44,7 +37,7 @@ runs:
     - name: pre-commit Cache
       id: pre-commit-cache
       if: inputs.cache-pre-commit == 'true'
-      uses: actions/cache@v4
+      uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
       with:
         path: ~/.cache/pre-commit/
-        key: cache-${{ inputs.cache-version }}-${{ runner.os }}-${{ runner.arch }}-pre-commit-${{ steps.pre-commit-version.outputs.pre-commit-version }}-python-${{ inputs.python-version }}-${{ steps.setup-python.outputs.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}
+        key: cache-${{ inputs.cache-version }}-${{ runner.os }}-${{ runner.arch }}-pre-commit-${{ steps.pre-commit-version.outputs.pre-commit-version }}-python-${{ inputs.python-version }}-${{ steps.setup-uv.outputs.python-version }}-${{ hashFiles('.pre-commit-config.yaml') }}