fix: fixed the token-permission and pinned dependencies

[harshitasao]

Description

fixed the token-permission and pinned dependencies reported by scorecard.

Related Issue

Part of #3441

Motivation and Context

Screenshots (if appropriate)

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Documentation Update (if none of the other choices apply)

Checklist

• My change requires a change to the documentation.
• I have updated the documentation accordingly.
• I have read the CONTRIBUTING document.
• I have added tests to cover my changes.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 52.53%. Comparing base (d68e707) to head (728f3f1).
Report is 40 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #3442      +/-   ##
==========================================
- Coverage   52.64%   52.53%   -0.11%     
==========================================
  Files         194      194              
  Lines       20587    20587              
==========================================
- Hits        10837    10815      -22     
- Misses       8942     8962      +20     
- Partials      808      810       +2     

Flag	Coverage Δ
unittests	52.53% <ø> (-0.11%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

see 6 files with indirect coverage changes

[gaius-qi]

@harshitasao Is it possible to use verison instead of git commit?

[gaius-qi]

Refer to #3513.