Add explicit read permissions to GitHub Actions workflows (#10)

* fix(security): remediate Dependabot and CodeQL alerts

Dependabot (benchmark/requirements.txt):
- Bump Pillow 9.2.0 -> 11.3.0 (fixes libwebp OOB write, arbitrary code
  execution, multiple DoS, buffer/integer overflow, and PDF trailer
  infinite-loop advisories)
- Bump fonttools 4.34.4 -> 4.63.0 (fixes XXE and varLib arbitrary file
  write / XML injection advisories)

CodeQL (GitHub Actions workflows):
- Add least-privilege top-level `permissions: contents: read` to
  asdf-lint, asdf-test, and golangci-lint workflows
- Pin third-party actions to commit SHAs:
  - asdf-vm/actions @ b7bcd02 (v4)
  - golangci/golangci-lint-action @ 82606bf (v9)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kw8Vc56aCTxc11n3oCd2kn

* chore(benchmark): upgrade Python deps to latest (14-day cutoff)

Re-resolved benchmark/requirements.txt from the sole direct dependency
(matplotlib) with uv, excluding releases newer than 2026-06-05. This
brings every package to its latest compatible version, picks up
prebuilt cp311 wheels (the old matplotlib 3.5.3 pin had none and failed
to build from source), and supersedes the earlier targeted Pillow/
fonttools security bumps:

- matplotlib 3.5.3 -> 3.10.9 (adds contourpy)
- numpy 1.23.1 -> 2.4.6
- pillow 9.2.0 -> 12.2.0
- fonttools 4.34.4 -> 4.63.0
- plus cycler, kiwisolver, packaging, pyparsing, python-dateutil, six

Verified: clean install in a fresh venv and graph.py renders all three
SVGs successfully.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01Kw8Vc56aCTxc11n3oCd2kn

---------

Co-authored-by: Claude <noreply@anthropic.com>

Author: IvMisticos

.github/workflows/asdf-lint.yml

@@ -8,6 +8,9 @@ on:
       - 'v*'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   shellcheck:
     runs-on: ubuntu-latest
@@ -16,7 +19,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install asdf dependencies
-        uses: asdf-vm/actions/install@v4
+        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
 
       - name: Run ShellCheck
         run: bin/scripts/shellcheck.bash
@@ -28,7 +31,7 @@ jobs:
         uses: actions/checkout@v6
 
       - name: Install asdf dependencies
-        uses: asdf-vm/actions/install@v4
+        uses: asdf-vm/actions/install@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
 
       - name: List file to shfmt
         run: shfmt -f .

.github/workflows/asdf-test.yml

@@ -8,6 +8,9 @@ on:
       - 'v*'
   pull_request:
 
+permissions:
+  contents: read
+
 jobs:
   plugin_test:
     name: asdf plugin test
@@ -19,10 +22,10 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
       - name: asdf_plugin_test
-        uses: asdf-vm/actions/plugin-test@v4
+        uses: asdf-vm/actions/plugin-test@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
         with:
           command: type kcc-cache
       - name: asdf_plugin_test
-        uses: asdf-vm/actions/plugin-test@v4
+        uses: asdf-vm/actions/plugin-test@b7bcd026f18772e44fe1026d729e1611cc435d47 # v4
         with:
           command: kcc-injector -h

.github/workflows/golangci-lint.yaml

@@ -6,6 +6,9 @@ on:
   pull_request:
     branches: ["main"]
 
+permissions:
+  contents: read
+
 jobs:
   golangci:
     name: lint
@@ -16,6 +19,6 @@ jobs:
         with:
           go-version: "1.26.4"
       - name: golangci-lint
-        uses: golangci/golangci-lint-action@v9
+        uses: golangci/golangci-lint-action@82606bf257cbaff209d206a39f5134f0cfbfd2ee # v9
         with:
           version: latest

benchmark/requirements.txt

@@ -1,10 +1,11 @@
-cycler==0.11.0
-fonttools==4.34.4
-kiwisolver==1.4.4
-matplotlib==3.5.3
-numpy==1.23.1
-packaging==21.3
-Pillow==9.2.0
-pyparsing==3.0.9
-python-dateutil==2.8.2
-six==1.16.0
+contourpy==1.3.3
+cycler==0.12.1
+fonttools==4.63.0
+kiwisolver==1.5.0
+matplotlib==3.10.9
+numpy==2.4.6
+packaging==26.2
+pillow==12.2.0
+pyparsing==3.3.2
+python-dateutil==2.9.0.post0
+six==1.17.0