CI: Pin scientific-python/upload-nightly-action to release sha (pydat…

…a#8662)

* For security best practices, use the action from known commit shas that
  correspond to tagged releases. These can be updated via dependabot.

.github/workflows/nightly-wheels.yml

@@ -38,7 +38,7 @@ jobs:
           fi
 
       - name: Upload wheel
-        uses: scientific-python/upload-nightly-action@main
+        uses: scientific-python/upload-nightly-action@6e9304f7a3a5501c6f98351537493ec898728299 # 0.3.0
         with:
           anaconda_nightly_upload_token: ${{ secrets.ANACONDA_NIGHTLY }}
           artifacts_path: dist