CI: pin remaining GitHub Actions to a commit SHA (4 spots missed by #3503, OSSF Pinned-Dependencies is 5/10 because of exactly these)

Summary

After #3503 ("[StepSecurity] Apply security best practices"), almost every workflow in this repo pins its uses: references to a full-length commit SHA (plus a # vX.Y.Z comment) and runs step-security/harden-runner. Four spots never got that treatment and still reference actions by a mutable major-version tag (@v3 / @v4 / @v5 / @v6), which upstream can repoint to a different commit without anything changing in this repo's own history — the exact risk #3503 already set out to close everywhere else.

This isn't a theoretical nitpick: it's precisely what this repo's own scorecard.yml / OSSF Scorecard run already flags today. The live Pinned-Dependencies score is 5/10 (queryable at https://api.securityscorecards.dev/projects/github.com/camel-ai/camel), and its detail list names these exact lines:

• .github/workflows/codeql.yml:62,72,101
• .github/workflows/docs_release_auto_sync_pr.yml:18,23,105
• .github/workflows/profiling.yml:44,116,122

There's a fourth spot Scorecard's check doesn't reach (it doesn't scan composite actions under .github/actions/), but it's consumed by five other workflows (documentation.yml, pre_commit.yml, profiling.yml, pytest_apps.yml, pytest_package.yml):

• .github/actions/camel_install/action.yml — actions/setup-python@v3, actions/cache/restore@v3, actions/cache/save@v3

Proposed fix

Same convention already used everywhere else in the repo (SHA + version comment). I checked each SHA against upstream git ls-remote --tags today (2026-09-08), dereferencing annotated tags with ^{} where needed:

# .github/workflows/codeql.yml
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
  # already the exact SHA used by every other workflow in this repo
- uses: github/codeql-action/init@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
- uses: github/codeql-action/analyze@cf1bb45a277cb3c205638b2cd5c984db1c46a412 # v4.31.7
  # same commit already pinned for codeql-action/upload-sarif in scorecard.yml

# .github/workflows/docs_release_auto_sync_pr.yml
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
- uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0
- uses: peter-evans/create-pull-request@c5a7806660adbe173f04e3e038b0ccdcd758773c # v6.1.0

# .github/workflows/profiling.yml
- uses: actions/cache@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
- uses: actions/cache/save@0057852bfaa89a56745cba8c7296529d2fc39830 # v4.3.0
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2

# .github/actions/camel_install/action.yml
- uses: actions/setup-python@3542bca2639a428e1796aaa6a2ffef0c0f575566 # v3.1.4
  # already the exact SHA pinned for the same action+tag in build_package.yml
- uses: actions/cache/restore@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0
- uses: actions/cache/save@6f8efc29b200d32929f49075959781ed54ec270c # v3.5.0

(Two of these — actions/[email protected] and actions/[email protected] — turn out to already be the exact same SHA this repo has pinned elsewhere for the same tag, so it's a copy, not a new pin to trust.)

I'm filing this as an issue rather than opening the PR directly, since CONTRIBUTING.md asks every PR to link a prior accepted issue/discussion. Happy to send the PR — essentially the diff above — once this is confirmed wanted.