ci: satisfy zizmor — pin actions and scope permissions

Pins all four action references to commit SHAs, keeping the version as a
trailing comment so the intent stays readable and Dependabot can still update
them. This was the reported failure: unpinned-uses is a mandatory check under a
blanket pin-to-hash policy.

Fixing only that would have left CI red, because the gate also fails on any
Medium finding and three more were present, all pre-existing:

- artipacked: actions/checkout persists the GITHUB_TOKEN into .git/config,
  which is reachable from build output and uploaded artifacts. The build job
  never pushes and the deploy job supplies its own token, so
  persist-credentials: false costs nothing.
- excessive-permissions (x2): the workflow declared no permissions, so both
  jobs ran with broad defaults. Deny at the top level and opt in per job --
  contents: read for build, and deploy keeps the contents: write it already had.

Verified with zizmor 1.29.0 locally: 'No findings to report', exit 0, where the
same run previously reported four errors plus three warnings. The build pipeline
is unaffected -- tests pass and the staged artifact is still byte-identical.

Note actions/checkout is pinned at v2, which is old enough to be worth bumping
on its own merits; left alone here to keep this change to the security fix.

Author: afq984

.github/workflows/actions.yml

@@ -5,15 +5,25 @@ on:
     branches: [main]
   pull_request:
 
+# Deny by default; each job opts in to what it needs.
+permissions: {}
+
 jobs:
   build:
+    permissions:
+      contents: read
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v2
+    # persist-credentials: false keeps the token out of .git/config, which is
+    # otherwise reachable from build output and uploaded artifacts. Nothing here
+    # pushes; the deploy job supplies its own token.
+    - uses: actions/checkout@0717577d45739eb3c851188b29f50ed6c0b2194e # v2
+      with:
+        persist-credentials: false
     # Bazel provides the Node toolchain, npm dependencies and browsers, so no
     # setup-node, package-manager install or playwright install step is needed.
     # All four caches default to false and must be enabled explicitly.
-    - uses: bazel-contrib/setup-bazel@0.19.0
+    - uses: bazel-contrib/setup-bazel@c5acdfb288317d0b5c0bbd7a396a3dc868bb0f86 # 0.19.0
       with:
         bazelisk-cache: true
         disk-cache: ${{ github.workflow }}
@@ -27,7 +37,7 @@ jobs:
     # convenience symlink.
     - name: Stage site
       run: bazel run //:stage_site
-    - uses: actions/upload-artifact@v4
+    - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
       with:
         name: out
         path: out/
@@ -39,7 +49,7 @@ jobs:
       contents: write
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/download-artifact@v4.1.7
+    - uses: actions/download-artifact@65a9edc5881444af0b9093a5e628f2fe47ea3b2e # v4.1.7
       with:
         name: out
         path: out/