fix: security hardening and CI workflow pinning

Author: hyperpolymath

.github/workflows/ci.yml

@@ -1,31 +1,43 @@
 name: CI
 
 on:
+npermissions: read-all
+
   push:
     branches: ["main"]
   pull_request:
 
 jobs:
   core-fill-tests:
     runs-on: ubuntu-latest
+npermissions: read-all
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
+npermissions: read-all
+
       - uses: dtolnay/rust-toolchain@stable
       - run: deno task test:core-fill
 
   extension-build:
     runs-on: ubuntu-latest
+npermissions: read-all
+
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8
       - uses: denoland/setup-deno@v2
         with:
           deno-version: v2.x
+npermissions: read-all
+
       - uses: dtolnay/rust-toolchain@stable
       - uses: jetli/wasm-pack-action@v0.4.0
         with:
           version: "latest"
+npermissions: read-all
+
       - run: deno task build:wasm
       - run: deno task build