ci: pin actions workflow step hashes and use minimum permissions

[zimeg]

⚠️ This is part of a maintenance update to ensure CI remains updated and in a working state.

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (3 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

[zimeg]

@WilliamBergamin Thanks so much for helping these parts of CI remain current 🤖 ✨