Harden GitHub Actions workflows

[felddy]

🗣 Description

This PR hardens the GitHub Actions workflows by:

• installing a hardened runner
• pinning dependencies to their hash
• limiting the default permissions of the GITHUB_TOKEN

💭 Motivation and Context

These changes were suggested by the security alerts of the Scorecard code security scanner.

🧪 Testing

Testing only in CI. These changes need to be in the default branch before they can be fully tested.

✅ Checklist

• This PR has an informative and human-readable title.
• Changes are limited to a single goal - eschew scope creep!
• All future TODOs are captured in issues, which are referenced in code comments.
• All relevant type-of-change labels have been added.
• I have read the CONTRIBUTING document.
• These code changes follow project standards.
• All relevant repo and/or project documentation has been updated to reflect
  the changes in this PR.
• Tests have been added to cover the changes in this PR.
• All new and existing tests pass.