fix(ci): pin pr-preview-deploy workflow actions to commit SHAs

- Update peter-evans/find-comment to v4.0.0 (pinned SHA)
- Update peter-evans/create-or-update-comment to v5.0.0 (pinned SHA)

Fixes GitHub Actions failure where v4 tag pointed to unavailable commit.
Uses commit SHAs instead of version tags for supply chain security.

.github/workflows/pr-preview-deploy.yml

@@ -50,7 +50,7 @@ jobs:
           command: pages deploy dist/browser --project-name=super-productivity-preview --branch=${{ github.head_ref }}
 
       - name: Find existing comment
-        uses: peter-evans/find-comment@v3
+        uses: peter-evans/find-comment@b30e6a3c0ed37e7c023ccd3f1db5c6c0b0c23aad # v4.0.0
         id: find-comment
         with:
           issue-number: ${{ github.event.pull_request.number }}
@@ -58,7 +58,7 @@ jobs:
           body-includes: '<!-- pr-preview-comment -->'
 
       - name: Create or update PR comment
-        uses: peter-evans/create-or-update-comment@v4
+        uses: peter-evans/create-or-update-comment@e8674b075228eee787fea43ef493e45ece1004c9 # v5.0.0
         with:
           comment-id: ${{ steps.find-comment.outputs.comment-id }}
           issue-number: ${{ github.event.pull_request.number }}