[LOW] Pin workflow actions and restrict token permissions

[OskarEichler]

Summary

This hardens all four GitHub Actions workflows against mutable action tags and over-broad implicit token defaults.

• pins all six external action repositories to the exact commits currently resolved by their major-version tags
• declares least-privilege permissions per workflow
• disables persisted checkout credentials where no later authenticated Git operation is needed

Risk

The label and locking workflows pass GITHUB_TOKEN to third-party actions selected by movable major tags. If one of those tags is moved or compromised, changed action code would run with the token permissions available to that workflow. Repository-level token defaults are not visible in source, so this PR does not claim broader source-write access.

Verification

• RBENV_VERSION=4.0.6-yjit rbenv exec bundle exec rspec: 244 examples, 0 failures
• all four workflow files parse with Ruby Psych
• every uses: selector resolves to a 40-character commit SHA
• git diff --check
• no test files changed

Local yamllint was unavailable; hosted checks remain the final workflow validation.

Compatibility

No gem runtime or packaged files change. No breaking changes.