chore(ci): pin external actions to commit SHAs and document policy

[yeongseon]

Priority: P2

Context

Sibling DX Toolkit repositories (azure-functions-db, azure-functions-doctor, azure-functions-scaffold) already document a strict "GitHub Actions Pinning" policy in CONTRIBUTING.md and pin every external uses: reference in .github/workflows/ to a full 40-character commit SHA. This repository is missing that policy section and has four unpinned refs in .github/workflows/e2e-azure.yml.

The rationale is the March 2025 tj-actions/changed-files supply-chain compromise (CVE-2025-30066), which exfiltrated CI secrets from ~23,000 repositories. Only workflows that had pinned to commit SHAs were safe. GitHub's own guidance now identifies SHA pinning as the only way to use an Action as an immutable release, and OpenSSF Scorecard flags weaker pinning as Medium-risk.

Acceptance Checklist

• Add ## GitHub Actions Pinning section to CONTRIBUTING.md matching the wording used in sibling repos (db, doctor, scaffold)
• Pin the following unpinned uses: references in .github/workflows/e2e-azure.yml to commit SHAs with trailing version comments:
  • actions/checkout@v7
  • azure/login@v3.0.0 (2 call sites)
  • actions/setup-python@v6
  • actions/upload-artifact@v7.0.1
• Verify all workflows still pass CI after the change

Out of scope

• Modifying pypa/gh-action-pypi-publish@release/v1 (approved exception — PyPA-recommended stable channel)
• Modifying local composite actions (uses: ./...)

References

• CVE-2025-30066: https://www.cisa.gov/news-events/alerts/2025/03/18/supply-chain-compromise-third-party-tj-actionschanged-files-cve-2025-30066
• GitHub hardening guidance: https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
• OpenSSF Scorecard Pinned-Dependencies: https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies
• Sibling reference: azure-functions-db/CONTRIBUTING.md (lines 46-102)