security: repair scanning and close stale alert sources

.github/workflows/dashboard-a11y.yml

@@ -19,11 +19,11 @@ jobs:
   a11y:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262
         with:
           submodules: recursive
 
-      - uses: dtolnay/rust-toolchain@stable
+      - uses: dtolnay/rust-toolchain@4cda84d5c5c54efe2404f9d843567869ab1699d4
         with: { targets: wasm32-unknown-unknown }
 
       - name: Install wasm-pack
@@ -36,7 +36,7 @@ jobs:
             --out-dir ../../dashboard/public/nvsim-pkg \
             --release -- --no-default-features --features wasm
 
-      - uses: actions/setup-node@v6
+      - uses: actions/setup-node@249970729cb0ef3589644e2896645e5dc5ba9c38
         with: { node-version: 20, cache: npm, cache-dependency-path: dashboard/package-lock.json }
 
       - working-directory: dashboard