Build/Test Tools: Pin SHA versions to the remaining 3rd party actions.

This also adds inline comments to the end of each action installed using a SHA value to make it easier to determine which version of an action is currently being used.

Follow up to [50474,50476].

Props johnbillion.
See #52625.

git-svn-id: https://develop.svn.wordpress.org/trunk@50486 602fd350-edb4-49c9-b593-d223f7449a82

.github/workflows/php-compatibility.yml

@@ -49,10 +49,10 @@ jobs:
 
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v2
+        uses: actions/checkout@5a4ac9002d0be2fb38bd78e4b4dbde5606d7042f # v2.3.4
 
       - name: Set up PHP
-        uses: shivammathur/setup-php@v2
+        uses: shivammathur/setup-php@afefcaf556d98dc7896cca380e181decb609ca44 # v2.10.0
         with:
           php-version: '7.4'
           coverage: none
@@ -64,7 +64,7 @@ jobs:
           composer --version
 
       - name: Install Composer dependencies
-        uses: ramsey/composer-install@v1
+        uses: ramsey/composer-install@92a7904348d4ad30236f3611e33b7f0c6f9edd70 # v1.1.0
         with:
           composer-options: "--no-progress --no-ansi --no-interaction"