ci: pin rust-toolchain to the commit its stable branch now points at

.github/workflows/binaries.yml

@@ -123,7 +123,7 @@ jobs:
         with:
           ref: refs/tags/${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
       # Pinned like every other dependency in this file: this job holds the
       # attestation credentials, so what it runs is part of what it attests.
       - name: Install cargo-cyclonedx

.github/workflows/fuzz.yml

@@ -36,7 +36,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
         with:
           toolchain: nightly
       - name: Install cargo-fuzz

.github/workflows/publish.yml

@@ -27,7 +27,7 @@ jobs:
           ref: ${{ inputs.tag || github.event.release.tag_name }}
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
 
       # Mints a 30-minute crates.io token from this run's OIDC identity. Both
       # crates carry a Trusted Publishing config naming this repository and this

.github/workflows/sonarqube.yml

@@ -45,7 +45,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@6bed0761d98439e5a578e2877258200ad565ba87 # stable
+      - uses: dtolnay/rust-toolchain@89b12181fb390509a0842a86cc55eeb8eb928c1d # stable
         with:
           components: llvm-tools-preview