Fix dependency submission action to use commit SHA

Use pinned commit hash (4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2) instead
of version tag @v5 to comply with Apache GitHub Actions policy.

Fixes #101

Author: tuhaihe

.github/workflows/dependency-submission.yml

@@ -41,7 +41,7 @@ jobs:
         working-directory: ./server
         run: make prepare-gradle-wrapper
       - name: Generate and submit dependency graph
-        uses: gradle/actions/dependency-submission@v5
+        uses: gradle/actions/dependency-submission@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2  # v5.0.0
         with:
           build-root-directory: server
           artifact-retention-days: 5