pinning

Also written: pin, pins, pinned

Fixing an exact version. `flask==3.1.3` pins a package, and `uses:` with a full commit SHA pins an action so its tag can't be moved to new code.