CI: use concrete action version

[lgoettgens]

This is recommended by the readme.

[codecov]

Codecov Report

Merging #172 (d04201f) into master (8dc359d) will increase coverage by 0.03%.
Report is 2 commits behind head on master.
The diff coverage is n/a.

@@            Coverage Diff             @@
##           master     #172      +/-   ##
==========================================
+ Coverage   77.58%   77.61%   +0.03%     
==========================================
  Files          11       11              
  Lines         736      746      +10     
==========================================
+ Hits          571      579       +8     
- Misses        165      167       +2     

Flag	Coverage Δ
unittests	77.61% <ø> (+0.03%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 2 files with indirect coverage changes

📣 We’re building smart automated test selection to slash your CI/CD build times. Learn more

[3f6a]

Actually the recommendation is to use SHA of the commit:

If your workflow requires access to secrets, you should always pin it to a commit SHA instead of a tag. This will protect you in case a bad actor gains access to the setup-julia repo. You can find more information in GitHub's security hardening guide.