ci: pin vendored action references

[devkoriel]

Summary

• Pin vendored OpenZeppelin action metadata references to immutable commit SHAs.
• Unblocks the org-wide external action SHA verifier before tightening GitHub Actions allowed-actions policy.

Pinned refs

packages/foundry/lib/openzeppelin-contracts/.github/actions/gas-compare/action.yml

• actions/upload-artifact@ff15f03 already pinned

packages/foundry/lib/openzeppelin-contracts/.github/actions/setup/action.yml

• actions/setup-node@3235b87 already pinned
• actions/cache@6f8efc2 already pinned
• foundry-rs/foundry-toolchain@c7450ba already pinned

packages/foundry/lib/openzeppelin-contracts/.github/actions/storage-layout/action.yml

• actions/upload-artifact@ff15f03 already pinned

Test plan

• Org-wide deep action SHA pinning scan will be rerun after merge.