fix: SHA-pin checkout action, add SPDX header and permissions

Author: hyperpolymath

.github/workflows/npm-bun-blocker.yml

@@ -1,10 +1,15 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 name: NPM/Bun Blocker
+
 on: [push, pull_request]
+
+permissions: read-all
+
 jobs:
   check:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
       - name: Block npm/bun
         run: |
           if [ -f "package-lock.json" ] || [ -f "bun.lockb" ] || [ -f ".npmrc" ]; then