ci: pin actions to full commit SHAs in ci-format-check and ci-mingw (#3253)

Mutable tag references can be silently re-pointed to different commits.
Pin to full SHA (tag kept as comment):

  neg-c/cmake-format-action:
    @v0.1.3 -> @ba83660ac46d64c12ca96f39478dcde7680a52bf
  msys2/setup-msys2:
    @v2 -> @66cd2cce69caa17b53920067426061ca1de3a884

.github/workflows/ci-format-check.yml

diff --git a/.github/workflows/ci-format-check.yml b/.github/workflows/ci-format-check.yml
index 8b5f33f..2a0c774 100644
--- a/.github/workflows/ci-format-check.yml
+++ b/.github/workflows/ci-format-check.yml
@@ -24,6 +24,6 @@
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: neg-c/cmake-format-action@v0.1.3
+      - uses: neg-c/cmake-format-action@ba83660ac46d64c12ca96f39478dcde7680a52bf # v0.1.3
         with:
           exclude: libavif.pc.cmake

.github/workflows/ci-mingw.yml

diff --git a/.github/workflows/ci-mingw.yml b/.github/workflows/ci-mingw.yml
index df1bc02..603ec47 100644
--- a/.github/workflows/ci-mingw.yml
+++ b/.github/workflows/ci-mingw.yml
@@ -27,7 +27,7 @@
         shell: msys2 {0}
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-      - uses: msys2/setup-msys2@v2
+      - uses: msys2/setup-msys2@66cd2cce69caa17b53920067426061ca1de3a884 # v2
         with:
           msystem: ${{ matrix.sys }}
           update: true