ci: pin reusable workflow references to commit SHAs (#54)

Signed-off-by: Ivan Pavlovic <ivan@gr-oss.io>

Author: pavlovic-ivan

.github/workflows/cd.yaml

@@ -9,7 +9,7 @@ on:
 
 jobs:
   maven-cd:
-    uses: jenkins-infra/github-reusable-workflows/.github/workflows/maven-cd.yml@v1
+    uses: jenkins-infra/github-reusable-workflows/.github/workflows/maven-cd.yml@7704ec4236e99ca271bdef1adb675b65b8e283a9 # v1
     secrets:
       MAVEN_USERNAME: ${{ secrets.MAVEN_USERNAME }}
       MAVEN_TOKEN: ${{ secrets.MAVEN_TOKEN }}

.github/workflows/jenkins-security-scan.yml

@@ -15,7 +15,7 @@ permissions:
 
 jobs:
   security-scan:
-    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@v2
+    uses: jenkins-infra/jenkins-security-scan/.github/workflows/jenkins-security-scan.yaml@da7438f10fecc21e40174d420ef34daae0874122 # v2
     with:
       java-cache: 'maven' # Optionally enable use of a build dependency cache. Specify 'maven' or 'gradle' as appropriate.
       # java-version: 21 # Optionally specify what version of Java to set up for the build, or remove to use a recent default.