[CI] Pin used GH Actions (#7716)

* pin used actions

plus some reordering and harmonization across files

* [CI] Link the version string and RNG stub into the test targets

The distribution libgtest.a now used by the Linux images makes the linker
pull more translation units out of libcockatrice_network than the fetched
googletest did. Those units reference VERSION_STRING and the global rng,
which several test targets never defined, so the instrumented Ubuntu 26.04
legs failed at link:

  undefined reference to `VERSION_STRING'
  undefined reference to `rng'

Add the generated version string source wherever a test links the network
umbrella, and define the rng stub in the tests that pull the server game
classes without declaring it. This matches what the neighbouring server
tests already do.

A full Debug build and ctest suite in the ci-ubuntu2604 image (system
libgtest.a) is green: 841 tests pass.

Fixes the nightly failures introduced by #6894.

---------

Co-authored-by: Lukas Brübach <44814898+BruebachL@users.noreply.github.com>

.github/workflows/translations-push.yml

@@ -16,15 +16,14 @@ on:
 
 jobs:
   translations:
+    name: "Push strings"
     # Do not run the scheduled workflow on forks
     if: github.event_name != 'schedule' || github.repository_owner == 'Cockatrice'
-
-    name: Push strings
-    runs-on: ubuntu-slim
+    runs-on: ubuntu-slim    # https://github.com/actions/runner-images/blob/main/images/ubuntu-slim/ubuntu-slim-Readme.md
 
     steps:
       - name: "Checkout repo"
-        uses: actions/checkout@v7
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 
       - name: "Install lupdate"
         shell: bash
@@ -37,20 +36,22 @@ jobs:
           FILE: cockatrice/cockatrice_en@source.ts
         id: cockatrice
         shell: bash
-        run: >
-          DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
+        run: |
+          export DIRS="cockatrice/src $(find . -maxdepth 1 -type d -name 'libcockatrice_*')"
           .ci/update_translation_source_strings.sh
 
       - name: "Update Oracle translation source"
         id: oracle
         shell: bash
         env:
-          DIRS: 'oracle/src'
-          FILE: 'oracle/oracle_en@source.ts'
+          DIRS: oracle/src
+          FILE: oracle/oracle_en@source.ts
         run: .ci/update_translation_source_strings.sh
 
       - name: "Render template"
         id: template
+        # Not pinnable to a SHA: the action downloads its release binary by ref name,
+        # so a commit ref matches no release tag.
         uses: chuhlomin/render-template/binary@v1
         with:
           template: .ci/update_translation_source_strings_template.md
@@ -62,7 +63,7 @@ jobs:
       - name: "Create pull request"
         if: github.event_name != 'pull_request'
         id: create_pr
-        uses: peter-evans/create-pull-request@v8
+        uses: peter-evans/create-pull-request@5f6978faf089d4d20b00c7766989d076bb2fc7f1 # v8.1.1
         with:
           add-paths: |
             cockatrice/cockatrice_en@source.ts