ci: pin action-gh-release to a commit sha

Pin the third-party release action to its exact commit rather than
the mutable v3 tag, so the workflow can't be affected if that tag is
ever repointed upstream.

Author: OmarAlJarrah

.github/workflows/release.yml

@@ -20,7 +20,7 @@ jobs:
         run: tar czf "morphic-test-assets-${SHA}.tar.gz" openapi/
 
       - name: Create GitHub release
-        uses: softprops/action-gh-release@v3
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           tag_name: ${{ github.sha }}
           name: ${{ github.sha }}