Three workflows pin third-party actions to `@master` instead of a tagged release

Three workflows reference third-party actions at a moving branch instead of a tagged release, so the action code that runs on every push and pull request changes whenever the upstream pushes to its default branch, with no review on this side.

The offending lines are .github/workflows/shellcheck.yml:19 (ludeeus/action-shellcheck@master), .github/workflows/pdd.yml:19 (volodya-lombrozo/pdd-action@master), and .github/workflows/xcop.yml:15 (g4s8/xcop-action@master). The eleven sibling workflows in .github/workflows/ all pin their uses: lines to a SemVer tag, so these three are the only outliers and break the convention the rest of the directory already established.

Pinning each of the three to its latest tagged release (or, stronger, to the commit SHA of that release) restores the convention, lets Renovate open update PRs against the same channel it already uses for the other actions, and removes the silent-change risk that an upstream owner could repoint master at any time. No other change is needed; the workflow steps and inputs stay as they are.