fix(ci): pin rotation workflow actions to commit SHAs (#2363)

The org requires all GitHub Actions to be pinned to a full-length commit
SHA; actions/checkout@v4 and actions/setup-python@v5 were rejected at
run time. Pin both to the same SHAs the repo's other workflows use.

Co-authored-by: Isaac

Author: serena-ruan

.github/workflows/discord-watch-rotation.yml

@@ -22,8 +22,8 @@ jobs:
   ping:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: "3.12" # for zoneinfo in the stdlib
       - name: Send rotation ping