fix(ci): pin release-please-action by commit SHA (not annotated-tag SHA) (#16)

PR #15 pinned googleapis/release-please-action @v4 to 8b8fd2cc — the
*tag object* SHA returned by gh api git/refs/tags/v4. OpenSSF
Scorecard's Pinned-Dependencies imposter-commit check rejects
tag-object SHAs because they aren't commits.

Dereference the annotated tag (gh api git/tags/<tag-obj>) -> commit
5c625bfb5d1ff62eadeeb3772007f7f66fdcf071.

Companion to Public_FATHOM #17 and Public_AccessibilityProject #23.

Author: NicolasDeNigris91

.github/workflows/release-please.yml

@@ -22,7 +22,7 @@ jobs:
   release-please:
     runs-on: ubuntu-latest
     steps:
-      - uses: googleapis/release-please-action@8b8fd2cc23b2e18957157a9d923d75aa0c6f6ad5 # v4
+      - uses: googleapis/release-please-action@5c625bfb5d1ff62eadeeb3772007f7f66fdcf071 # v4
         with:
           release-type: node
           # Single-package repo: no monorepo manifest needed; the action