[FEATURE]: Lock Down GitHub Actions

[adambkaplan]

Feature

Immediately update our org-wide GitHub Actions default policy configurations to the following:

• Change the default permission of the GITHUB_TOKEN to be read-only for contents and packages .
• Require GitHub Actions workflows to be pinned by SHA.
• Require GitHub Actions to be explicitly approved for participants .

Background

Recent software supply chain attacks have exposed critical weaknesses in GitHub Actions defaults. This proposes immediate, potentially breaking changes to how we manage GitHub Actions permissions.

I am proposing this change as part of the Shipwright community's response to the Trivy ecosystem compromise.

[qu1queee]

Sounds good. 1) and 3) need to be modified at the org level.