Done with pin-github-action <https://github.com/mheap/pin-github-action>
1.8.0 using `npx pin-github-action .github/workflows/*.yml`, and then
manually bumping the version tag to the relevant number.

This fixes the issue that it is common practice for GitHub Actions
authors to move major tags when releasing new minor versions.

Dependabot supports updating in the same fashion, bumping the version
tag when updating the hash.

feat: Pin actions to hashes

Bumps [actions/checkout](https://github.com/actions/checkout) from 4.1.1 to 4.2.2.
- [Release notes](https://github.com/actions/checkout/releases)
- [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md)
- [Commits](actions/checkout@b4ffde6...11bd719)

---
updated-dependencies:
- dependency-name: actions/checkout
  dependency-version: 4.2.2
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

…/checkout-4.2.2

chore(deps): bump actions/checkout from 4.1.1 to 4.2.2

Fixes #229.