ci: harden release-plz — SHA-pin actions, no credential persistence

Pin actions/checkout (v6), dtolnay/rust-toolchain (stable), and
MarcoIeni/release-plz-action (v0.5) to commit SHAs so a hijacked moving tag
cannot run with access to RELEASE_PLZ_TOKEN / CARGO_REGISTRY_TOKEN, and set
persist-credentials: false. release-plz pushes via its env token, so PRs
keep triggering CI.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: brevity1swos

.github/workflows/release-plz.yml

@@ -13,11 +13,12 @@ jobs:
     name: Release-plz
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6
         with:
           fetch-depth: 0
-      - uses: dtolnay/rust-toolchain@stable
-      - uses: MarcoIeni/release-plz-action@v0.5
+          persist-credentials: false
+      - uses: dtolnay/rust-toolchain@29eef336d9b2848a0b548edc03f92a220660cdb8 # stable
+      - uses: MarcoIeni/release-plz-action@e8792575c7f2366cf6ff3ccc33ead9ace5b691c7 # v0.5
         env:
           GITHUB_TOKEN: ${{ secrets.RELEASE_PLZ_TOKEN }}
           CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}