Update GitHub Actions to use specific commit SHA for create-release and upload-release-asset actions

Author: kapravel

.github/workflows/provenance.yml

@@ -43,7 +43,7 @@ jobs:
           SOCKET_CLI_DEBUG: ${{ inputs.debug }}
       - name: Create GitHub Release
         id: create_release
-        uses: actions/create-release@v1
+        uses: actions/create-release@0cb9c9b65d5d1901c1f53e5e66eaf4afd303e70e # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -56,7 +56,7 @@ jobs:
           draft: false
           prerelease: false
       - name: Upload Package to Release
-        uses: actions/upload-release-asset@v1
+        uses: actions/upload-release-asset@e8f9f06c4b078e705bd2ea027f0926603fc9b4d5 # v1
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with: