Lock actions in CI (#2829)

* update dockerfile

* lock actions

* remove dockerhub

* fix golangci-lint install in ci image

.github/workflows/testing.yml

@@ -9,8 +9,8 @@ jobs:
     container:
       image: ghcr.io/jguer/yay-builder:latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/cache@v3
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+      - uses: actions/cache@27d5ce7f107fe9357f9df03efb73ab90386fccae # v5.0.5
         with:
           path: ~/go/pkg/mod
           key: ${{ runner.os }}-go-${{ hashFiles('**/go.sum') }}
@@ -36,7 +36,7 @@ jobs:
           GOFLAGS: -buildvcs=false -tags=next
         run: make
       - name: Upload yay Artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: yay
           path: ./yay