Pin third-party Actions

[Iron-Mark]

What changed

• pin every subosito/flutter-action@v2 use to the current immutable v2 commit
• pin every android-actions/setup-android@v4 use to the current immutable v4 commit
• retain major-version comments so future maintenance remains clear
• update release source guards to require the approved immutable SHAs and reject the old moving tags

Why

CodeQL opened six medium-severity actions/unpinned-tag alerts. Moving action tags can be retargeted upstream, while full commit SHAs make workflow dependencies immutable.

The first CI attempt exposed two source-guard expectations that still required the old moving Android tag. Those guards now enforce the pinned revisions instead.

Impact

Workflow behavior and configured tool versions are unchanged. The same upstream action revisions are now referenced by SHA.

Validation

• git diff --check
• CodeQL passed on the pinned workflow commit
• verified all six flagged references use 40-character commit SHAs
• resolved the pinned SHAs directly from the upstream v2 and v4 tag refs
• full CI rerun pending; Flutter is not installed in the local Windows environment