Pin Swatinem/rust-cache action to a full commit SHA

[JohnTitor]

Using third-party actions introduces some risks, and GitHub suggests that you should pin them to a full-length commit SHA: https://docs.github.com/en/actions/reference/security/secure-use#using-third-party-actions
Also, GitHub recently shipped a feature to reject such a usage: https://github.blog/changelog/2025-08-15-github-actions-policy-now-supports-blocking-and-sha-pinning-actions/

This repo is exposed as a composite action; end-users cannot enable the above feature due to the Swatinem/rust-cache@v2 line, like: Error: The action swatinem/rust-cache@v2 is not allowed in owner/repo because all actions must be pinned to a full-length commit SHA.
This fixes that issue by pinning it.

[robjtede]

after finding out that hash pinning works fine with dependabot, lgtm 👍🏻

[jonasbb]

Thank you for the PR. This seems necessary for better security. Disabling the caching is not enough to prevent this error message.

The rust-cache action is not that active that it would be a burden to update the pinned hashes.