Fix Scorecard pin dependencies issues

[jerbly]

There are 5 pin dep issues that this should clear. A couple of them are download-then-run issues so a verify step against the sha is added.

This does add more maintenance on our plates - renovate can't cover the custom sha verification steps.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 82.2%. Comparing base (f52329c) to head (6dbee0b).

Additional details and impacted files

@@          Coverage Diff          @@
##            main   #1445   +/-   ##
=====================================
  Coverage   82.2%   82.2%           
=====================================
  Files        125     125           
  Lines      10241   10241           
=====================================
  Hits        8423    8423           
  Misses      1818    1818           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[lquerel]

LGTM