fix(ci): pin docker/* actions to ASF-approved SHAs in publish-docker (#406)

The publish-docker workflow used floating @v3 tags for docker/login-action,
docker/setup-qemu-action, and docker/setup-buildx-action. The ASF GitHub
Actions allow-list only approves specific SHAs for third-party actions, so
the workflow was rejected at startup (startup_failure) on master pushes.

This workflow only runs on push-to-master and release, never on PRs, so the
rejection did not surface in PR CI — it first failed when #388 merged.

Pin all three to the approved SHAs already used across the sibling ASF
SkyWalking repos:
  - docker/login-action@650006c6...      # v4.2.0
  - docker/setup-qemu-action@06116385...  # v4.1.0
  - docker/setup-buildx-action@d7f5e7f5... # v4.1.0