fix: harden GitHub Actions workflows

[fzipi]

what

• pin all GitHub Actions to full-length commit SHAs instead of mutable tags
• add top-level permissions blocks to all workflows

why

• unpinned actions using tag references (e.g. @v4) are vulnerable to tag mutation attacks where a compromised or malicious upstream can replace the tag to point to different code
• workflows without explicit permissions inherit the default token permissions, which may be overly broad and violate the principle of least privilege

refs

• https://docs.github.com/en/actions/security-for-github-actions/security-guides/security-hardening-for-github-actions#using-third-party-actions
• https://blog.stepsecurity.io/github-actions-supply-chain-security-best-practices-1b3e1a0e5f24