ci: pin actions workflow step hashes and use minimum permissions

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Category

• Others

Testing

🔍 Watching ci for these truths!

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (1 ignored, 4 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Requirements

Please read the Contributing guidelines and Code of Conduct before creating this issue or pull request. By submitting, you are agreeing to those rules.

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've run ./scripts/install_all_and_run_tests.sh after making the changes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 90.96%. Comparing base (f1c0048) to head (fea2e9a).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@ Coverage Diff @@## main #1303 +/- ##
=======================================
Coverage 90.96% 90.96% =======================================
Files 222 222 Lines 7501 7501 =======================================
Hits 6823 6823 Misses 678 678 

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[WilliamBergamin]

Thanks for working on this 💯

[zimeg]

@WilliamBergamin Without reviews from the kind reviewer it'd be perhaps moot work. Thanks as well! I am merging this PR now 🚀