ci: pin actions workflow step hashes and use minimum permissions

[zimeg]

Summary

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Testing

🔍 Watching CI for these results! But I hope nothing has changed.

Category

• tests/integration_tests (Automated tests for this library)
• Other

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (4 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Requirements

• I've read and understood the Contributing Guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.
• I've run python3 -m venv .venv && source .venv/bin/activate && ./scripts/run_validation.sh after making the changes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 85.33%. Comparing base (81d10be) to head (6d00b80).

✅ All tests successful. No failed tests found.

Additional details and impacted files

@@ Coverage Diff @@## main #1691 +/- ##
==========================================
- Coverage 85.36% 85.33% -0.04% 
==========================================
Files 113 113 Lines 12808 12808 ==========================================
- Hits 10934 10930 -4 - Misses 1874 1878 +4 

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[zimeg]

@WilliamBergamin Certified awesome sauceome in all of these reviews so far. I appreciate it a lot and will merge this to celebrate 🤖 ✨