Harden GitHub Actions workflows

[mraible]

This PR hardens GitHub Actions workflows by applying security best practices:

• Pinned actions to commit SHAs: All GitHub Actions are now pinned to their full commit SHA instead of tags, preventing supply chain attacks
• Added harden-runner: The step-security/harden-runner action monitors runtime behavior and network egress
• Set minimum permissions: GITHUB_TOKEN permissions are explicitly set to minimum required (contents: read)

Security Improvements

• Protection against compromised actions through commit SHA pinning
• Runtime network egress monitoring and audit logging
• Principle of least privilege for GitHub tokens
• Compliance with GitHub security best practices

Testing

All existing CI checks should pass without modification. The hardened workflows are functionally equivalent to the originals with added security layers.

References

• StepSecurity Harden Runner
• GitHub Actions Security Best Practices