Harden GitHub workflows

[samdark]

Summary

• Pin reusable yiisoft/actions workflows to a commit SHA.
• Replace unsafe pull_request_target workflow triggers with pull_request where present.
• Set read-only GITHUB_TOKEN permissions for read-only workflows.

Validation

• zizmor --no-progress --no-exit-codes yii-debug-api/.github/workflows

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

❌ Patch coverage is 21.42857% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 10.25%. Comparing base (91cf2f1) to head (62ec52d).

Files with missing lines	Patch %	Lines
src/Inspector/Test/CodeceptionJSONReporter.php	0.00%	4 Missing ⚠️
src/Inspector/Test/PHPUnitJSONReporter.php	0.00%	4 Missing ⚠️
src/Inspector/Command/CodeceptionCommand.php	0.00%	1 Missing ⚠️
src/Inspector/Command/PHPUnitCommand.php	0.00%	1 Missing ⚠️
src/Inspector/Command/PsalmCommand.php	0.00%	1 Missing ⚠️

Additional details and impacted files

@@             Coverage Diff              @@
##             master     #161      +/-   ##
============================================
+ Coverage     10.20%   10.25%   +0.04%     
- Complexity      268      271       +3     
============================================
  Files            26       26              
  Lines          1274     1278       +4     
============================================
+ Hits            130      131       +1     
- Misses         1144     1147       +3     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.