ci: update GitHub actions workflows

[dsanders11]

• Updates and pins SHAs for actions
• Restricts permissions for actions
• Bump Node.js version on docs workflow to v18 to clear deprecation warning

[continuous-auth[bot]]

:tada: This PR is included in version 2.0.3 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: