[StepSecurity] Apply security best practices

[stepsecurity-app]

Summary

This pull request has been generated by StepSecurity as part of your enterprise subscription to ensure compliance with recommended security best practices. Please review and merge the pull request to apply these security enhancements.

At a high level, this PR:

• Adds the harden-runner Action if not already present
• Pins Actions to a digest rather than mutable tags
• Restricts GitHub token permissions to be as minimal as possible

Security Fixes

Harden Runner

Harden-Runner is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without sudo access.

• GitHub Security Guide
• The Open Source Security Foundation (OpenSSF) Security Guide

Feedback

For bug reports, feature requests, and general feedback; please create an issue in step-security/secure-repo or contact us via our website.

[eslerm]

Ref https://github.com/chainguard-dev/prodsec/issues/138

[eslerm]

chainguard-dev/malcontent#927 (comment)

I believe the scorecard Workflow only allows for two third-party Actions with harden-runner being one of them, so that should be fine to add in a separate PR.

cc @egibs