installation: use concrete SHA1 for workflow

• The workflow dependence is taken from Roman's github because pypi does not contain new version yet. This commits adds concrete SHA1 when cloning from github for safety so that we would be using a concrete workflow version that is known to work, not relying on theoretically bleeding edge.

Signed-off-by: Tibor Simko <tibor.simko@cern.ch>
Co-authored-by: Jiri Kuncar <jiri.kuncar@cern.ch>