CI: pin actions by SHA

This eliminates the possibility of a tag being changed under
us.

Author: tacaswell

.github/workflows/release.yaml

@@ -25,4 +25,4 @@ jobs:
 
       - name: Publish to PyPI
         if: github.event_name == 'push' && startsWith(github.ref, 'refs/tags')
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@76f52bc884231f62b9a034ebfe128415bbaabdfc # v1.12.4