CI: Ratchet down permissions, hash-pin actions

[woodruffw]

Hi there! Thanks for maintaining junction.

As part of my periodic review of the crates that we rely on for uv, I've gone and ahead and proposed (via this PR) some defense-in-depth enhancements to your GitHub Actions setup. These aren't critical, but they reduce the number of permissions available to the workflow and make it more hermetic/reproducible.

Key changes:

• I've set permissions: {} at the top-level, which all jobs will inherit. This shouldn't cause any breakage, as none of your current CI jobs need extra permissions. When they do, you can always widen at the per-job level.
• I've set persist-credentials: false on every actions/checkout usage, to disable GitHub's default behavior of persisting your GITHUB_TOKEN onto disk.
• I've hash-pinned all of your action references using pinact run -v. However, I haven't updated them; I recommend using Dependabot or Renovate to auto-update actions (with an appropriate cooldown).

Please let me know if there's anything else I can do, including answer other questions about what I've done 🙂

[tesuji]

lgtm. Will merge when CI green.

[woodruffw]

Thanks @tesuji!