Ref actions by commit SHA in lint.yml

It's important to make sure the SHA's are from the original repositories and not forks.

For reference:

https://github.com/actions/setup-go/releases/tag/v4.0.1
fac708d667

https://github.com/actions/checkout/releases/tag/v3.5.2
8e5e7e5ab8

https://github.com/golangci/golangci-lint-action/releases/tag/v3.5.0
5f1fec7010


Signed-off-by: Gabriela Gutierrez <gabigutierrez@google.com>

.github/workflows/lint.yml

@@ -16,13 +16,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Setup go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@fac708d6674e30b6ba41289acaab6d4b75aa0753 # v4.0.1
         with:
           go-version: 1.17
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
       - name: Setup golangci-lint
-        uses: golangci/golangci-lint-action@v3
+        uses: golangci/golangci-lint-action@5f1fec7010f6ae3b84ea4f7b2129beb8639b564f # v3.5.0
         with:
           args: --verbose
           version: latest