[Task]: Make github actions more secure

[KevinMind]

Description

Based on a great analysis there are a few recommendations we should consider for our repositor(ies)y.

Acceptance Criteria

### Milestones/checkpoints
- [ ] verify dependabot from event.<event>.user instead of event.actor
- [ ] add ossf scorecard scanning tool for our repos to detect unsafe workflows
- [ ] analyze our supply chain and ensure we are only using highly trusted sources (most is our own code and mozilla limits what we can use already but doesn't hurt
- [ ] Drop default permissions globally and only request appropriate permissions where needed

Checks

• [x] If I have identified that the work is specific to a repository, I have removed "repository:addons-server" or "repository:addons-frontend"

┆Issue is synchronized with this Jira Task

[diox]

(might want to move this to a better epic later)

[bkochendorfer]

I'd also recommend checking out Zizmor

[fkiriakos07]

we also added guidance regarding docker image security

[KevinMind]

We should consider adding sanitization to inputs. Generally speaking I don't think we ever expect inputs to be anything other than static strings so we could sanitize everything.

Though I'm not sure to what extent actions already does this..