[GOODBOY008]

Purpose of the pull request

Four workflow steps still reference third-party actions through mutable version tags. Pin them to full commit SHAs to comply with the ASF GitHub Actions policy. The ASF allowlist has wildcard entries for these actions, so the existing allowlist check does not enforce SHA pinning for them.

What's changed?

• Pin EnricoMi/publish-unit-test-result-action to v2.25.0 in Java CI and the nightly build.
• Pin taiki-e/install-action to v2.88.1 in the license-header check.
• Pin peaceiris/actions-gh-pages to v4.1.0 in the documentation deployment.
• Add version comments beside the hashes, following Apache Superset and Apache Iceberg Rust.

Each new hash was verified against its upstream release tag. All nine third-party action references now use full commit SHAs. Existing GitHub Actions Dependabot configuration continues to manage updates.

Validation

• Actionlint v1.7.12 passed for all 10 workflows.
• ASF allowlist checker passed for all 15 distinct action references.
• YAML comparison confirmed that only the four intended action references changed.
• git diff --check passed.

Checklist

• I have read the Contributor Guide.
• I have written the necessary doc or comment.
• I have added the necessary unit tests and all cases have passed. (Not applicable: workflow reference changes only; validation is listed above.)