Harden Workflow Security

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR is related to add OpenSSF best practices and FAIR rating badge #1077
• Tests for the changes have been added (for bug fixes / features)
  • (If applicable) Documentation has been added / updated (for bug fixes / features)
• CHANGES.rst has been updated (with summary of main changes)
  • Link to issue (:issue:number) and pull request (:pull:number) has been added

What kind of change does this PR introduce?

• Adds the harden-runner action step to all relevant workflows
• Sets basic permissions on all relevant workflows
• Sets actions-version-updater.yml to use a more constrained token

Does this PR introduce a breaking change?

No, but GitHub Workflows are more secure.

Other information:

https://securityscorecards.dev/viewer/?uri=github.com%2FOuranosinc%2Fxclim
https://github.com/step-security/harden-runner

[github-actions]

Note
It appears that this Pull Request modifies the main.yml workflow.

On inspection, the XCLIM_TESTDATA_BRANCH environment variable is set to the most recent tag (v2023.12.14).

No further action is required.

[coveralls]

coverage: 90.303%. remained the same
when pulling 2657d0c on hash-pinning
into fec1c74 on master.