Improve the Actions workflows

[jessehouwing]

After the security issues from the past days, I took a look at the Actions infrastructure and was wondering whether you'd want some support. A quick read of the disclosure indicates a number of potential things that would be helpful to prevent similar issues in the future.

I'd love to help out here...

Things that immediately spring to mind:

1. Set the default permissions for all actions to read only
2. Set job level permissions in workflows.
3. Enable free GitHub Advanced Security Code Scanning for GitHub Actions
4. Optionally add a required workflow which runs ActionLint and/or GHAS on actions.
5. Enable Dependabot for Actions & Upgrade existing actions
6. Pin all actions to SHA instead of tag
7. Add pull_request_target to Secret Scanning as a push protection pattern.
8. Consider Hardened Runner from StepSecurity to detect runners going out of bounds
9. break critical workflows into separate workflow and call them using a callable workflow.

[jessehouwing]

Now with a extensive blog post explaining each possible remediation:

https://jessehouwing.net/github-actions-learnings-from-the-recent-nx-hack/