Commit hash pinning in GitHub Actions: secure, but at a cost