Pin action-gh-release to a commit and move it to 3.0.2

The release job holds the npm trusted-publishing identity and a write-scoped
token, so the third-party action it runs is referenced by commit rather than by
a tag that can be moved to point at different code.

3.0.0 moved the action's runtime from Node 20 to Node 24 and changed no inputs,
which also clears the Node 20 deprecation warning the release run emits.

Author: beaugunderson

.github/workflows/release.yml

@@ -21,6 +21,9 @@ jobs:
       - run: npm ci
       - run: npm test
       - run: npm publish --provenance --access public
-      - uses: softprops/action-gh-release@v2
+      # Pinned to a commit rather than a tag: this job holds the npm
+      # trusted-publishing identity and a write-scoped token, so the third-party
+      # code it runs should not be able to change under a moved tag.
+      - uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           generate_release_notes: true