Update version comments to vX.Y.Z tags.

When we use `vX` instead, `zizmor` complains about values like `0def53c0fd8534bc13416c9469f5be45265824fd # v1`: That commit was `v1.6.3`, which `v1` presumably _used_ to point to (so it _was_ fine), but now `v1` points to `v1.6.4`, which is a different commit.

(I wonder if out-of-sync comments still ever [prevent Dependabot from updating them](https://github.com/dependabot/dependabot-core/issues/13197#issuecomment-3357374469)—though the case here seems different than that one.)

Current [warning](https://docs.zizmor.sh/audits/#ref-version-mismatch):

```
ref-version-mismatch
Check warning: ref-version-mismatch
ci.yml:98: action's hash pin has mismatched or missing version comment: points to commit 5298d94fb55a
```

Author: cpovirk

.github/workflows/ci.yml

@@ -55,12 +55,12 @@ jobs:
     continue-on-error: ${{ matrix.experimental }}
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Set up JDK ${{ matrix.java }} from jdk.java.net"
         if: ${{ matrix.java == 'EA' }}
-        uses: oracle-actions/setup-java@ec7274acdd237c7fe61395ed2edda22d756b5afe # v1
+        uses: oracle-actions/setup-java@fff43251af9936a0e6a4d5d0946e14f1680e9b6b # v1.5.0
         with:
           website: jdk.java.net
           release: ${{ matrix.java }}
@@ -91,11 +91,11 @@ jobs:
     continue-on-error: true
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Set up GraalVM ${{ matrix.java }}"
-        uses: graalvm/setup-graalvm@0def53c0fd8534bc13416c9469f5be45265824fd # v1
+        uses: graalvm/setup-graalvm@5298d94fb55a4f185c602eeac5de1b553882abe2 # v1.6.4
         with:
           java-version: "25"
           distribution: "graalvm-community"
@@ -117,7 +117,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: "Check out repository"
-        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
       - name: "Set up JDK 21"