Update actions/checkout action to v4

.github/workflows/ci.net.yaml

@@ -13,7 +13,7 @@ jobs:
     name: Test .net ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up environment
         run: ./bootstrap.cmd
       - name: Test with .Net

.github/workflows/ci.yaml

@@ -14,7 +14,7 @@ jobs:
     name: Test JDK ${{ matrix.java }}, ${{ matrix.os }}
 
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:

.github/workflows/coveralls.yaml

@@ -23,7 +23,7 @@ jobs:
     if: github.repository_owner == 'waffle-OFF'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:

.github/workflows/coverity.yaml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'waffle'
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:

.github/workflows/site.yaml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'waffle' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with:

.github/workflows/sonar.yaml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'waffle'
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
         with:
           # Disabling shallow clone is recommended for improving relevancy of reporting
           fetch-depth: 0

.github/workflows/sonatype.yaml

@@ -10,7 +10,7 @@ jobs:
     if: github.repository_owner == 'waffle' && ! contains(toJSON(github.event.head_commit.message), '[maven-release-plugin]')
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
+      - uses: actions/checkout@3df4ab11eba7bda6032a0b82a6bb43b11571feac # v4
       - name: Set up JDK
         uses: actions/setup-java@v3
         with: