Pin gradle/actions/wrapper-validation to commit SHA to satisfy code scanning

Fixes "Insecure GitHub Actions: Third-Party Action Not Pinned to Commit SHA"
flagged by GitHub Advanced Security on PR #2803. Pins to the commit SHA
corresponding to v4 while keeping the tag as a comment for readability.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>