Pin Codeql actions versions

[mmorel-35]

Which problem is this PR solving?

• Related to [Feature]: Improvement of OpenSSF Scorecard Score #5815

Description of the changes

• Pin Codeql actions versions

How was this change tested?

Checklist

• I have read https://github.com/jaegertracing/jaeger/blob/master/CONTRIBUTING_GUIDELINES.md
• I have signed all commits
• I have added unit tests for the new functionality
• I have run lint and test steps successfully
  • for jaeger: make lint test
  • for jaeger-ui: yarn lint and yarn test

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 96.79%. Comparing base (8f2543c) to head (e138a16).

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #5875   +/-   ##
=======================================
  Coverage   96.79%   96.79%           
=======================================
  Files         342      342           
  Lines       16525    16525           
=======================================
  Hits        15996    15996           
  Misses        341      341           
  Partials      188      188           

Flag	Coverage Δ
badger_v1	8.05% <ø> (ø)
badger_v2	1.81% <ø> (ø)
cassandra-3.x-v1	16.61% <ø> (ø)
cassandra-3.x-v2	1.74% <ø> (ø)
cassandra-4.x-v1	16.61% <ø> (ø)
cassandra-4.x-v2	1.74% <ø> (ø)
elasticsearch-6.x-v1	18.77% <ø> (-0.02%)	⬇️
elasticsearch-7.x-v1	18.84% <ø> (+0.01%)	⬆️
elasticsearch-8.x-v1	19.03% <ø> (+0.01%)	⬆️
elasticsearch-8.x-v2	1.80% <ø> (ø)
grpc_v1	9.52% <ø> (ø)
grpc_v2	7.14% <ø> (ø)
kafka-v1	9.74% <ø> (ø)
kafka-v2	1.81% <ø> (ø)
memory_v2	1.81% <ø> (ø)
opensearch-1.x-v1	?
opensearch-2.x-v1	18.88% <ø> (-0.02%)	⬇️
opensearch-2.x-v2	1.81% <ø> (ø)
unittests	95.27% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[yurishkuro]

Why do we need this? It does not improve security of repeatable builds, and only creates maintenance overhead.

[mmorel-35]

That's https://securityscorecards.dev/viewer/?uri=github.com/jaegertracing/jaeger

See pinned dependencies.

You can learn more on the official documentation with
https://github.com/ossf/scorecard/blob/ea7e27ed41b76ab879c862fa0ca4cc9c61764ee4/docs/checks.md#pinned-dependencies

[yurishkuro]

Yes, I am familiar with this the scorecard's mistaken opinion on the subject. There are deps that affect the build of the artifacts, and those should be pinned. But there are workflows (like linters) which do not produce artifacts and can actually benefit from using "latest" deps.