ci: pin actions by hash + drop permissions

[pjonsson]

Related Issue(s):

• Excessive CI permissions #1618

Description:

Pin actions by hash and drop permissions at the top level for the jobs that do not have any permissions specified.

PR Checklist:

• Pre-commit hooks pass (run pre-commit run --all-files)
• Tests pass (run pytest)
• Documentation has been updated to reflect changes, if applicable
• This PR maintains or improves overall codebase code coverage
• This PR's title is formatted per conventional commits

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.22%. Comparing base (dc4aa7c) to head (e6b2b22).
⚠️ Report is 2 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1619   +/-   ##
=======================================
  Coverage   92.22%   92.22%           
=======================================
  Files          55       55           
  Lines        8411     8411           
  Branches      973      973           
=======================================
  Hits         7757     7757           
  Misses        466      466           
  Partials      188      188           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[jsignell]

Looks good!