chore: pin actions to digests and introduce step security hardened runners

[jedsalazar]

Pin GitHub Actions to a digest to prevent supply chain attacks. Adds Step Security Github Actions Harden Runner agent, which monitors for least privilege GITHUB_TOKEN permissions and egress connections. More info here

[azenla]

ooh nice!