ci(security): harden CI/CD supply chain with SHA pinning and least-privilege permissions

ci(security): harden CI/CD supply chain with SHA pinning and least-privilege permissions #683