ci: pin oven-sh/setup-bun to a commit SHA

[eliottreich]

Pins oven-sh/setup-bun from the mutable v2 tag to the exact commit that tag points to today (0c5077e51419...) in build.yml (3 places), keeping a # v2 comment. A mutable tag can be re-pointed upstream; pinning to a commit SHA makes the action immutable, the GitHub-recommended hardening for third-party actions. Dependabot (already configured here) can keep the pin current.

• If you've added code that should be tested, please add tests. — N/A, CI configuration change only.
• Ensure your code lints and the test suite passes. — N/A, no application code changed; ref-only edit.
• Link an issue if there is one. — no issue; happy to open one if preferred.

Ref-only: the pinned SHA is the exact commit v2 resolves to today, so behavior is unchanged.

A repository-specific security report with the other categories reviewed (public files only): https://www.task-bounty.com/fix-more?repo=getsentry/sentry-javascript

_{Prepared by TaskBounty. Glad to adjust or close if this isn't useful.}