arrow

GH-36898: [CI] Hashpin Sensitive GitHub Actions (#37676)

### Rationale for this change

Explained on issue #36898

### What changes are included in this PR?

For security reasons, it hashpins the calls for github actions that are called with sensitive permission (usually `pull-requests: write`) or with secrets used on the same context. I'm not hashpinning every action call because the tag-pinning flexibility can be useful if used with caution, e.g. in testing environment.

### Are these changes tested?

Not tested, but the changes on this PR shouldn't change any comportment of the CI, as we'd still be using the exact same version, but pinned differently.

### Are there any user-facing changes?

No
* Closes: #36898

Authored-by: Diogo Teles Sant'Anna <diogoteles@google.com>
Signed-off-by: Jacob Wujciak-Jens <jacob@wujciak.de>