CI: pin actions/checkout to a commit SHA

semgrep's github-actions-mutable-action-tag rule (now running, after the
pip install was fixed) flags actions/checkout@v3 as a mutable tag that
could be repointed upstream (supply-chain risk). Pin all four uses to the
SHA the v3 tag currently resolves to (v3.6.0), preserving behavior.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitea/workflows/lint.yml

@@ -11,7 +11,7 @@ jobs:
     name: PHP (phpcs PSR-12)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install PHP and phpcs
         run: |
@@ -27,7 +27,7 @@ jobs:
     name: JS (eslint)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install ESLint
         run: npm install --save-dev eslint@8
@@ -39,7 +39,7 @@ jobs:
     name: PHP requirements (version + extensions)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install PHP with required extensions
         run: |

.gitea/workflows/security.yml

@@ -13,7 +13,7 @@ jobs:
     name: PHP Security (semgrep)
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3.6.0
 
       - name: Install semgrep
         run: |