ci: pin gem-push workflow actions to immutable commit SHAs

The gem-publish workflow resolved actions/checkout, ruby/setup-ruby and
rubygems/configure-rubygems-credentials from mutable tags (@V3 / @v1 /
@v2.0.0). A hijacked or force-pushed upstream tag could redirect the
resolved action code into the job that publishes the gem (CWE-829,
supply-chain injection). Pin all three to full 40-char commit SHAs, with
a version comment, matching the pattern the repo's Semgrep.yml already uses.

- actions/checkout            -> c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
- ruby/setup-ruby             -> a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
- rubygems/configure-rubygems-credentials -> 762a4b77c3300434bb57c7ce80b20e36231927aa # v2.0.0

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: 07souravkunda

.github/workflows/gem-push.yml

@@ -11,13 +11,13 @@ jobs:
       id-token: write
 
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
     - name: Set up Ruby 2.6
-      uses: ruby/setup-ruby@v1
+      uses: ruby/setup-ruby@a0102e0972be65f351c307e2d64b9314a57c8073 # v1.324.0
       with:
         ruby-version: 2.6.10
 
-    - uses: rubygems/configure-rubygems-credentials@v2.0.0
+    - uses: rubygems/configure-rubygems-credentials@762a4b77c3300434bb57c7ce80b20e36231927aa # v2.0.0
     - name: Build and push gem
       run: |
         gem build *.gemspec