fix(ci): pin create-github-app-token to a commit SHA

This action mints an installation token from the tap App's private key,
so pin it to an immutable commit (v2.2.2) rather than the movable v2 tag
to remove the supply-chain risk of a retagged release exfiltrating the
key. Addresses CodeRabbit review on #28.

Author: elkaix

.github/workflows/homebrew-tap.yml

@@ -78,7 +78,7 @@ jobs:
       # other than the one this workflow runs in.
       - name: Mint GitHub App token for the tap repo
         id: app-token
-        uses: actions/create-github-app-token@v2
+        uses: actions/create-github-app-token@fee1f7d63c2ff003460e3d139729b119787bc349 # v2.2.2
         with:
           app-id: ${{ secrets.HOMEBREW_TAP_APP_ID }}
           private-key: ${{ secrets.HOMEBREW_TAP_APP_PRIVATE_KEY }}