Update and pin GitHub actions (#211)

Using `pinact run --update`

<https://github.com/suzuki-shunsuke/pinact>

Also: dependabot will continue functioning as usual, and it also knows
how to update the version comments.

.github/workflows/publish-docs.yml

@@ -13,10 +13,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
 
       - name: Setup mdBook
-        uses: peaceiris/actions-mdbook@v2
+        uses: peaceiris/actions-mdbook@ee69d230fe19748b7abf22df32acaa93833fad08 # v2.0.0
         with:
           # if this changes, change it in .github/workflows/checks.yml as well
           mdbook-version: '0.4.48'
@@ -24,7 +24,7 @@ jobs:
       - run: mdbook build docs
 
       - name: Deploy
-        uses: peaceiris/actions-gh-pages@v4
+        uses: peaceiris/actions-gh-pages@84c30a85c19949d7eee79c4ff27748b70285e453 # v4.1.0
         with:
           github_token: ${{ secrets.GITHUB_TOKEN }}
           publish_dir: ./docs/book