CI: Harden GHA configuration

[tacaswell]

Apply recommended hardening steps including:

• pinning to a SHA any actions used
• not persisting the read token on checkout
• setting the default permissions
• adding a depandabot file for GHA