Pin exact versions of images and actions

Floating tags (17-alpine, 3.4-slim, nginx:alpine, :latest, :debug, @v7)
change under a deploy without anyone deciding it: the storage deploy
moved Postgres to 17.12 on its own because of postgres:17-alpine. Pin
every image and action to its exact current version, so each change
arrives as a reviewed Renovate PR and a rollback is a revert.

Assisted-by: Claude:opus-5-5

.forgejo/workflows/deploy.yaml

@@ -32,7 +32,7 @@ jobs:
         run: nix-env -iA nixpkgs.nodejs_22
 
       - name: Checkout
-        uses: actions/checkout@v7
+        uses: actions/checkout@v7.0.1
 
       - name: Set up credentials
         env: