security: pin GitHub Actions to full commit SHA and bump to latest

[mugioka]

Closes #4

📝 Change Type

• 🆕 New database toolbox image
• 🔧 Bug fix (non-breaking change that fixes an issue)
• ✨ Feature enhancement (new capability to existing toolbox)
• 📚 Documentation update
• 🔄 CI/CD or infrastructure change
• 🧪 Tests or examples
• ⚠️ Breaking change (requires version bump)

🎯 Description

✅ Testing Checklist

• Built Docker image(s) locally
• Tested image with --stdio flag (MCP mode)
• Verified environment variables work correctly
• Tested connection to actual database (if applicable)
• Ran existing test suite
• Added new tests for new functionality
• Updated examples in README
• Tested on both amd64 and arm64 architectures (if possible)

🔗 Related Issues

• Closes security: pin GitHub Actions to full commit SHA and bump to latest versions #4

✍️ Author Checklist

• Code follows project style guidelines
• Self-reviewed the code changes
• Commented complex or non-obvious code
• Updated relevant documentation
• No warnings or errors in CI pipeline
• Commit messages are clear and descriptive

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[mugioka]

@marcosfede
Hi.
Would it be possible for you to review this PR?