Pin dependencies: not just list version but specify commit hash

[cherriechang]

Tracking issue for:

• https://github.com/jspsych/jsPsych/security/code-scanning/13
• https://github.com/jspsych/jsPsych/security/code-scanning/12
• https://github.com/jspsych/jsPsych/security/code-scanning/11
• https://github.com/jspsych/jsPsych/security/code-scanning/10
• https://github.com/jspsych/jsPsych/security/code-scanning/9
• https://github.com/jspsych/jsPsych/security/code-scanning/8
• https://github.com/jspsych/jsPsych/security/code-scanning/7
• https://github.com/jspsych/jsPsych/security/code-scanning/6
• https://github.com/jspsych/jsPsych/security/code-scanning/5
• https://github.com/jspsych/jsPsych/security/code-scanning/4
• https://github.com/jspsych/jsPsych/security/code-scanning/3
• https://github.com/jspsych/jsPsych/security/code-scanning/2
• https://github.com/jspsych/jsPsych/security/code-scanning/1

Instructions
Code
Documentation

Basically pin dependencies involved in each GitHub Action workflow