CI: Harden GHA configuration

[tacaswell]

Apply recommended hardening steps including:

• pinning to a SHA any actions used
• not persisting the read token on checkout
• setting the default permissions to read-only

[maffettone]

The super linter now fails to locate files in the .github/actions/* directories. These are subscripts used for tests and cpp lint. Is this due to the permissions change? I don't see why it would be, but am confused by the error message.

  Error: -09 13:39:51 [ERROR]   Found errors when linting GITHUB_ACTIONS. Exit code: 1.
  2025-07-09 13:39:51 [INFO]   Command output for GITHUB_ACTIONS:
  ------
  .github/workflows/ros.yaml:22:15: file ".github/actions/test/run.sh" does not exist in "/github/workspace/.github/actions/test". it is specified at "entrypoint" key in "runs" section in "Test" action [action]
     |
  22 |         uses: ./.github/actions/test/
     |               ^~~~~~~~~~~~~~~~~~~~~~~
  .github/workflows/ros.yaml:37:15: file ".github/actions/lint/run.sh" does not exist in "/github/workspace/.github/actions/lint". it is specified at "entrypoint" key in "runs" section in "Lint" action [action]
     |
  37 |         uses: ./.github/actions/lint/
     |               ^~~~~~~~~~~~~~~~~~~~~~~
  ------

[tacaswell]

One thing that is happening is that superlinter only runs on files that are touched so if you have not been touching the GHA files, they have not been being linted.

My read on this is that the linter and GHA are disagreeing about the root to resolve relative paths at is at looks like the task is is indeed running, but I think the linter is complaining that /github/workspace/.github/actions/lint/.github/actions/lint/run.sh does not exist.