Pin GH action source to a SHA

[mmertsock]

https://github.com/mmertsock/eskergames/blob/main/.github/workflows/deploy-main.yml - pin the action mentioned in uses using a SHA hash or whatever, to ensure integrity of external dependency