ci: Resolve ref-version-mismatch, stale-action-refs, superfluous-actions, and unpinned-uses

[hashcatHitman]

In pursuit of getting more zizmor lints enforced across rust-lang repos through crabwatch, this PR fixes all findings of the ref-version-mismatch, stale-action-refs, superfluous-actions, and unpinned-uses rules (there were no findings for unpinned-uses in this repo, though).

For actions/checkout, it seems 6.0.2 may have been re-tagged at some point. You can compare the old commit and the new commit here: https://github.com/actions/checkout/compare/de0fac2e4500dabe0009e67214ff5f5447ce83dd..0c366fd6a839edf440554fa01a7085ccba70ac98

The only difference is changelog entries being added.

For dtolnay/rust-toolchain, it seems like re-tagging is the only tagging it knows. Fortunately, rustup is already installed on ubuntu-latest, windows-latest, and macos-latest. Switching to using rustup directly clears ref-version-mismatch and stale-action-refs, with the added benefit of clearing superfluous-actions.

The hash pin format is supported by tools like Dependabot and Renovate, which can update the pinned hashes and their associated comments. If you'd like help setting either of those up, let me know which you prefer, and if you'd like it in this PR or a new one.

[Thomasdezeeuw]

Why can't we use dtolnay/rust-toolchain?

View changes since the review

[hashcatHitman]

1. It doesn't really offer much over using rustup directly, especially for very simple toolchain needs like we have here. So using this action instead of the pre-installed rustup does extra work and increases our attack surface/supply chain risk. Even if dtolnay already has write access to this repo (I don't know if they do or not), depending on this action when we don't need to is just a possible path to compromise in the future when they might not have write access anymore. (which, to be clear, I am not suggesting I think dtolnay is going to try to do anything. I am suggesting if dtolnay were to have their account or credentials compromised, the attackers could then act on their behalf)
2. It doesn't have proper releases/tags. The only release/tag is v1, and the tag just gets moved around to new commits, making it impossible to properly satisfy ref-version-mismatch and stale-action-refs. We could tell zizmor/crabwatch to ignore those lints, but because there's no proper version comment that would match the hash consistently, Dependabot can't keep this action updated. An alternative would be to track the literal tag v1 or the master branch itself, which should remove the need to update the action to get additional fixes, but that leads to unpinned-uses failing, which is also not desirable. Similarly, we could configure zizmor/crabwatch to ignore that as well, but unless there's a concrete reason to prefer the action over using rustup directly, it's just better for our security posture to do away with it.

Ultimately, my goal is just to get the lints to pass so we can enable them and improve our security posture across the rust-lang repos. It is preferable to replace the action with rustup directly, but if you have a reason to prefer the action, there are other ways I can satisfy the lints. If you do have a reason and want to keep using the action, I'd need to know if you'd rather stick on a commit, which puts you at risk of falling far behind on updates, or if you'd rather track the tag/branch directly, which leads to less stability and slightly increased supply chain risk over using a commit or rustup directly.