VAULT-14696: Pin 3rd party actions (#21782)

* use shas instead of versions and fix milestones

* remove trailing space

.github/configs/milestone-check.json

@@ -1,8 +0,0 @@
-[
-    {
-      "type": "check-milestone",
-      "title": "Milestone Check",
-      "success": "Milestone set",
-      "failure": "Milestone not set"
-    }
-  ]

.github/workflows/ci.yml

@@ -342,7 +342,7 @@ jobs:
       - test-go-race
     steps:
       - name: Download failure summary
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@9bc31d5ccc31df68ecc42ccf4149144866c47d8a # v3.0.2
         with:
           name: failure-summary
       - name: Prepare failure summary

.github/workflows/milestone-checker.yml

@@ -19,16 +19,5 @@ jobs:
     if: "!contains(github.event.pull_request.labels.*.name, 'pr/no-milestone')"
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout Actions
-        uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-        with:
-          repository: "grafana/grafana-github-actions"
-          path: ./actions
-          ref: main
-      - name: Install Actions
-        run: npm install --production --prefix ./actions
-      - name: Run PR Checks
-        uses: ./actions/pr-checks
-        with:
-          token: ${{secrets.GITHUB_TOKEN}}
-          configPath: configs/milestone-check
+      - name: Check milestone
+        run: ${{ github.event.pull_request.milestone != null }}

.github/workflows/oss.yml

@@ -68,7 +68,7 @@ jobs:
       - if: github.event.pull_request != null && steps.changes.outputs.ui == 'true'
         run: echo "PROJECT=171" >> "$GITHUB_ENV"
 
-      - uses: actions/add-to-project@v0.3.0   # TSCCR: no entry for repository "actions/add-to-project"
+      - uses: actions/add-to-project@a9f041ddd462ed185893ea1024cec954f50dbe42 # v0.3.0 # TSCCR: no entry for repository "actions/add-to-project"
         with:
           project-url: https://github.com/orgs/hashicorp/projects/${{ env.PROJECT }}
           github-token: ${{ secrets.TRIAGE_GITHUB_TOKEN }}