Improve workflow security

[busma13]

Ref: terascope/teraslice#4461

• Always pin all action and reusable workflow versions with a commit hash and check for impostor commits
• Always set permissions at the workflow level to disable all permissions by default. Then, grant only the specific permissions needed at the job level.
• sanitize user input - check for env variables that could be controller by user
• eliminate all static credentials from your workflows
• Eliminate secrets: inherit while reusing workflows
• Mask all sensitive information that is not a GitHub secret by using ::add-mask::{value}
• actions/checkout should be used with persist-credentials: false