CI: Improve Security Posture

[tisba]

I recently read a couple of GH action security articles and thought it might be worth applying some of the findings here.

• Dropping default permissions of GH token via permissions: {}
• actions/checkout: Opt-out of persisting git credentials as we only checkout code. From the https://github.com/actions/checkout:

  The auth token is persisted in the local git config. This enables your scripts to run authenticated git commands. The token is removed during post-job cleanup. Set persist-credentials: false to opt-out.

• pin actions to their git SHA, rather than a floating tag. Using # v4 after the definition, allows Dependabot to still update those. This way we know exactly which action we're using.