Fix pinning of github actions (#5213)

It is recommended to pin github actions with hash so that an action
is not posing an unknown security risk (as the actions itself is not
written by us).

Signed-off-by: Yong Tang <yong.tang.github@outlook.com>

.github/workflows/go.tidy.yml

@@ -9,13 +9,13 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Install Go
-        uses: actions/setup-go@v2
+        uses: actions/setup-go@bfdd3570ce990073878bf10f6b2d79082de49492
         with:
           go-version: '1.17.0'
         id: go
 
       - name: Checkout
-        uses: actions/checkout@v2
+        uses: actions/checkout@ec3a7ce113134d7a93b817d10a8272cb61118579
 
       - name: Tidy
         run: |