pin actions to commit SHAs in workflows (#744)

* fix basic validation with npm command

* Revert "fix basic validation with npm command"

This reverts commit 27a0803a2ab96426d0c31f6d2d725ea6fbc20c2f.

* pin workflow actions to full commit SHAs with patch

* update cooldown

* update redundant global.json test and rollForward fields

* update cooldown for npm section

.github/workflows/publish-immutable-actions.yml

@@ -14,7 +14,7 @@ jobs:
 
     steps:
       - name: Checking out
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Publish
         id: publish
-        uses: actions/publish-immutable-action@v0.0.4
+        uses: actions/publish-immutable-action@4bc8754ffc40f27910afb20287dbbbb675a4e978 # v0.0.4