The actions actions/checkout@v4, microsoft/devskim-action@v1, and github/codeql-action/upload-sarif@v3 are not allowed in BcryptNet/bcrypt.net because all actions must be pinned to a full-length commit SHA.