UID2-6913: Pin third-party GitHub Action refs to commit SHAs

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: jon8787

.github/workflows/docker-image.yml

@@ -33,7 +33,7 @@ jobs:
             type=sha,prefix=server_only-,format=short
             type=raw,prefix=server_only-,value=latest
       - name: Build and push Docker server_only image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: publisher/server_only
           push: true
@@ -62,7 +62,7 @@ jobs:
             type=sha,prefix=standard-,format=short
             type=raw,prefix=standard-,value=latest
       - name: Build and push Docker standard image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: publisher/standard
           push: true
@@ -91,7 +91,7 @@ jobs:
             type=sha,prefix=reverse-proxy-,format=short
             type=raw,prefix=reverse-proxy-,value=latest
       - name: Build and push Docker reverse-proxy image
-        uses: docker/build-push-action@v5
+        uses: docker/build-push-action@ca052bb54ab0790a636c9b5f226502c73d547a25 # v5
         with:
           context: tools/reverse-proxy
           file: Dockerfile