CI: use hashes for actions' versions in publishing job

[bsipocz]

No description provided.

[andyfaff]

@bsipocz, what's your experience with trusted publishing? Do you think it would be worth considering for numpy/numpy releases?

[larsoner]

My (unsolicited) 2c -- I use trusted publishing in several projects and it has been very easy to set up by following the instructions, would recommend 👍

Thanks @bsipocz !

[bsipocz]

@andyfaff - I use it in smaller projects and have good experiences, but to be honest I'm not sure how it would be for something like numpy that has a more complicated release procedure and a lot of flavours of wheels to be produced and released. (I would expect a one-time not very easy but not super difficult setup, and then a couple of cycles of frustrations when the logic is not working as expected with partial build issues).