Security hardening for GH actions workflows

[musicEnfanthen]

To harden the security of the GitHub action workflow runners, there are multiple steps to consider:

[ ] pin actions to a full length commit SHA (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)

• should be combined with automatic updates, e.g. with Dependabot (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-dependabot-version-updates-to-keep-actions-up-to-date)

[ ] restrict token permissions to minimum needed (https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#restricting-permissions-for-tokens)

[musicEnfanthen]

Just leaving this here for future reference.