Pin actions to SHA and use Microsoft JDK in publish-snapshot workflow

- Pin actions/checkout to de0fac2e @ v6.0.2
- Pin actions/setup-java to be666c2f @ v5
- Switch JDK distribution from temurin to microsoft

Cherry-picked from edburns/dd-2785864-pre-public-non-code-changes

Author: edburns

.github/workflows/publish-snapshot.yml

@@ -18,17 +18,17 @@ jobs:
         name: Publish SNAPSHOT to Maven Central
         runs-on: ubuntu-latest
         steps:
-            - uses: actions/checkout@v6
+            - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
               with:
                   fetch-depth: 0
 
             - uses: ./.github/actions/setup-copilot
 
             - name: Set up JDK 17
-              uses: actions/setup-java@v5
+              uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5
               with:
                   java-version: "17"
-                  distribution: "temurin"
+                  distribution: "microsoft"
                   cache: "maven"
                   server-id: central
                   server-username: MAVEN_USERNAME