pin actions to commit SHAs in workflows (#744)

* fix basic validation with npm command

* Revert "fix basic validation with npm command"

This reverts commit 27a0803a2ab96426d0c31f6d2d725ea6fbc20c2f.

* pin workflow actions to full commit SHAs with patch

* update cooldown

* update redundant global.json test and rollForward fields

* update cooldown for npm section

.github/workflows/test-dotnet.yml

@@ -28,7 +28,7 @@ jobs:
         dotnet-version: ['8.0', '9.0', '10.0']
     steps:
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Clear toolcache
         shell: pwsh
         run: __tests__/clear-toolcache.ps1 ${{ runner.os }}