ci: pin action hashes and escape variables with minimum permission

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (5 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Testing

🔍 Let's use CI for these checks!

Special notes

🎶🎷🦕 This dino is making jazz sounds!

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've ran deno task test after making the changes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 98.54%. Comparing base (ca8fc2c) to head (5c783f2).
Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main     #460   +/-   ##
=======================================
  Coverage   98.54%   98.54%           
=======================================
  Files          67       67           
  Lines        2743     2743           
  Branches      148      148           
=======================================
  Hits         2703     2703           
  Misses         40       40           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[WilliamBergamin]

Nice 💯

[zimeg]

@WilliamBergamin Thanks! In continuation of jazz sounds I will merge this PR.