Pin GHA versions and git hook versions

[peytondmurray]

This PR fixes zizmor lint issues for the github actions. Specifically:

• Action versions are now pinned to commit hashes instead of git refs
• GITHUB_TOKEN permissions are now as little as necessary for each job. For jobs where elevated permissions are required, it is scoped only to the job that needs those permissions, not the entire workflow.
• A few places where template injection could have happened have been resolved

Also, the pre-commit hooks have been autoupdated and then frozen. This required ignoring some old test files from the name-tests-test hook.