pin GitHub Actions to commit SHAs and restrict workflow permissions

[yashsingh74]

Summary

This PR hardens our GitHub Actions workflows against supply-chain compromise by pinning third-party actions to full 40-character commit SHAs and explicitly defining least-privilege permissions: blocks for GITHUB_TOKEN.

Problem

1. Mutable Version Tags: Workflows in .github/workflows/test.yaml and .github/workflows/release.yaml referenced third-party actions using mutable major version tags (e.g., @v2, @v3, @v9).
2. Unscoped Token Permissions: Neither workflow declared explicit permissions blocks, leaving GITHUB_TOKEN with default repository write access across all execution steps.

Proposed Changes

• SHA Pinning: Replaced all mutable version tags in third-party
• Least-Privilege Scoping:
  • Added a global permissions: contents: read block to test.yaml and release.yaml.
  • Scoped permissions: contents: write exclusively to the asset publishing job in release.yaml.
• Automated Digest Maintenance: Enabled pin-github-action-digests: true in .github/dependabot.yml so Dependabot automatically bumps SHA digests in future PRs.