fix: SHA-pin checkout action, add SPDX header and permissions

Author: hyperpolymath

.github/workflows/wellknown-enforcement.yml

@@ -1,4 +1,6 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
 name: Well-Known Standards (RFC 9116 + RSR)
+
 on:
   push:
     branches: [main, master]
@@ -13,11 +15,13 @@ on:
     - cron: '0 9 * * 1'
   workflow_dispatch:
 
+permissions: read-all
+
 jobs:
   validate:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6.0.1
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: RFC 9116 security.txt validation
         run: |