fix(ci): pin action SHAs with correct version comments

zizmor flagged the checkout SHA comment as `# v6` when it's actually
pinned to v6.0.2. Also pin create-github-app-token to its commit SHA
instead of the rolling `@v3` tag.

.github/workflows/sync-release-changelog.yml

@@ -64,14 +64,14 @@ jobs:
       - name: Generate GitHub App token
         if: steps.find-pr.outputs.found == 'true'
         id: app-token
-        uses: actions/create-github-app-token@v3
+        uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
         with:
           client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
           private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
 
       - name: Check out release PR branch
         if: steps.find-pr.outputs.found == 'true'
-        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           ref: ${{ steps.find-pr.outputs.branch }}
           fetch-depth: 0