ci: pin all GitHub Actions to SHA hashes and update versions (#1681)

Update action versions and pin to full SHA commit hashes.
Windows build parallelization is disabled to avoid hung CI.

.github/workflows/codeql-analysis.yml

@@ -24,6 +24,8 @@ jobs:
   analyze:
     name: Analyze
     runs-on: ubuntu-latest
+    env:
+      CODEQL_ACTION_FILE_COVERAGE_ON_PRS: true
     permissions:
       actions: read
       contents: read
@@ -37,14 +39,14 @@ jobs:
     steps:
     - name: Checkout Source Files
       id: checkout
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
     - name: Initialize CodeQL
       id: init-codeql
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13 # v4
       with:
         languages: ${{ matrix.language }}
 
     - name: Perform CodeQL Analysis
       id: perform-codeql-analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13 # v4