ci: pin third-party actions to commit SHAs

Bump actions/checkout from v3 to v7.0.1, as v3 runs on the deprecated node16
runtime. Bump fsfe/reuse-action from v1 to v6.0.0.

Signed-off-by: Andrei Gherzan <andrei@gherzan.com>

.github/workflows/yocto-layer.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: [self-hosted, Linux]
     steps:
       - name: Checkout the code
-        uses: actions/checkout@v3
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           fetch-depth: 0
       - name: Check for Yocto relevant changes