chore: [StepSecurity] Apply security best practices (hiero-ledger#2092)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: stepsecurity-app[bot] <188008098+stepsecurity-app[bot]@users.noreply.github.com>
Co-authored-by: exploreriii <133720349+exploreriii@users.noreply.github.com>

Author: 2 people

.github/workflows/codeql.yml

@@ -10,6 +10,9 @@ on:
     schedule:
         - cron: "28 23 * * *" # Runs every day at 23:28 UTC.
 
+permissions:
+  contents: read
+
 jobs:
     analyze:
         name: Analyze (${{ matrix.language }})

.github/workflows/pr-check-secondary-unit-integration-test.yml

@@ -174,6 +174,11 @@ jobs:
     if: always()
 
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
       - name: Print summary and fail when any test job failed
         shell: bash
         run: |

.github/workflows/sync-issue-labels-compute.yml

@@ -190,6 +190,11 @@ jobs:
     if: ${{ needs.compute-labels.outputs.is_fork_pr != 'true' }}
     runs-on: ubuntu-latest
     steps:
+      - name: Harden the runner (Audit all outbound calls)
+        uses: step-security/harden-runner@fa2e9d605c4eeb9fcad4c99c224cee0c6c7f3594 # v2.16.0
+        with:
+          egress-policy: audit
+
       - name: Trigger add workflow
         uses: step-security/workflow-dispatch@acca1a315af3bf7f33dd116d3cb405cb83f5cbdc # v1.2.8
         with: