ci: pin third-party actions to commit SHAs

Bump actions/checkout from v3 to v7.0.1, as v3 runs on the deprecated node16
runtime. Bump fsfe/reuse-action from v1 to v6.0.0.

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>

.github/workflows/compliance.yml

@@ -13,7 +13,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Build a temporary DCO image
@@ -41,9 +41,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Do reuse check
         continue-on-error: true
-        uses: fsfe/reuse-action@v1
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0

.github/workflows/yocto-builds.yml

@@ -32,7 +32,7 @@ jobs:
       SSTATE_DIR: /var/lib/ci/yocto/sstate
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Check for Yocto relevant changes

.github/workflows/yocto-layer.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: [self-hosted, Linux]
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Check for Yocto relevant changes