ci: pin actions workflow step hashes and use minimum permissions

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Testing

🔍 Let's let CI do this for us!

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (1 ignored, 4 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Special notes

💌 Thanks for reviewing these changes!

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've run ./scripts/install_and_run_tests.sh after making the changes.

[codecov-commenter]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 94.68%. Comparing base (04f3c33) to head (acd6f53).

Additional details and impacted files

@@           Coverage Diff           @@
##             main      #58   +/-   ##
=======================================
  Coverage   94.68%   94.68%           
=======================================
  Files          11       11           
  Lines         207      207           
=======================================
  Hits          196      196           
  Misses         11       11           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[WilliamBergamin]

[zimeg]

@WilliamBergamin The end is near! For at least this set of CI permission updates. I so hope at least 😉

Merging this brings us one step closer to whatever that end might be so I will do that 🚢 💨