ci: pin danger action to full-length commit SHA

[Flash0ver]

I noticed that the "Danger" action is not pinned to the full-length commit SHA.
This is a follow-up to issue #4540 (PR #4562).

[Flash0ver]

@sentry review

[sentry]

The update to pin the danger action to a specific commit SHA (13be9bec4ec5cd67061b747972b996e9c80f4f3b) is a good practice for enhancing security and reproducibility. This ensures that the workflow always runs with the exact same action code, preventing unexpected changes from upstream updates to the @v3 tag.

However, this approach also means that any future bug fixes or security patches released by the getsentry/github-workflows/danger action maintainers (within the 3.x series) will not be automatically applied. These updates will require a manual change to the SHA in this workflow.

Given the inline comment # 3.1.0, it suggests an intent to use version 3.1.0. If the primary goal is to track this specific minor version and automatically receive patch updates, consider using @v3.1.0 instead of the full SHA. This offers a balance between stability and ease of maintenance. If absolute immutability is the highest priority, then the current SHA pinning is appropriate, but be mindful of the need for manual updates for any patches.
_{Severity: MEDIUM}

🤖 Prompt for AI Agent

Review the code at the location below. A potential bug has been identified by an AI
agent.
Verify if this is a real issue. If it is, propose a fix; if not, explain why it's not
valid.

Location: .github/workflows/danger.yml#L11

Potential issue: The update to pin the `danger` action to a specific commit SHA
(`13be9bec4ec5cd67061b747972b996e9c80f4f3b`) is a good practice for enhancing security
and reproducibility. This ensures that the workflow always runs with the exact same
action code, preventing unexpected changes from upstream updates to the `@v3` tag.

However, this approach also means that any future bug fixes or security patches released
by the `getsentry/github-workflows/danger` action maintainers (within the `3.x` series)
will not be automatically applied. These updates will require a manual change to the SHA
in this workflow.

Given the inline comment `# 3.1.0`, it suggests an intent to use version 3.1.0. If the
primary goal is to track this specific minor version and automatically receive patch
updates, consider using `@v3.1.0` instead of the full SHA. This offers a balance between
stability and ease of maintenance. If absolute immutability is the highest priority,
then the current SHA pinning is appropriate, but be mindful of the need for manual
updates for any patches.

_{Did we get this right? 👍 / 👎 to inform future reviews.
Reference_id: 2803320}

[Flash0ver]

@dependabot is automatically updating GitHub actions.
See e.g. #4715.
It's also updating the version-comment appropriately.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.70%. Comparing base (9a61615) to head (4e25543).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4753      +/-   ##
==========================================
+ Coverage   73.69%   73.70%   +0.01%     
==========================================
  Files         476      476              
  Lines       17443    17443              
  Branches     3453     3453              
==========================================
+ Hits        12854    12856       +2     
+ Misses       3741     3740       -1     
+ Partials      848      847       -1     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.