Security hardening for GH actions workflows

[musicEnfanthen]

To harden the security of the GitHub action workflow runners, there are multiple steps to consider:

• [ ] pin actions to a full length commit SHA (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
• [ ] should be combined with automatic updates, e.g. with Dependabot (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-dependabot-version-updates-to-keep-actions-up-to-date)
• [ ] restrict token permissions to minimum needed (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#restricting-permissions-for-tokens)

[musicEnfanthen]

Just leaving this here for future reference.

[lpugin]

@musicEnfanthen I re-formatted you initial comment. Please double check that it is three points and not two