ci: pin action hashes and escape variables with minimum permission

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Category

• Others

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (2 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Requirements

• I've read and agree to the Code of Conduct.
• I've run ./scripts/install_all_and_run_tests.sh after making the changes.

[WilliamBergamin]

These are valid changes but I wonder if we should archive this project I don't think it properly represents the manifest schema anymore

[zimeg]

@WilliamBergamin I was wondering the same, but I think it'd be worth encouraging contributions here since this can be a valuable tool for direct manifest edits 🤔

I often consult app settings or docs but inline hints would be ideal for most changes IMO.

FWIW I found an outdated community schema for similar effect, but it seems better to maintain this ourselves? I found a few internal definitions we might want to explore if this is interesting 📚 ✨

I'll merge this now and will hope to follow up with maintenance in the next free time I find 😉