ci: pin actions to commit SHAs and restrict permissions

[creed-bratton]

Actions pinned to mutable tags are vulnerable to tag-moving supply chain attacks.

• Pin all actions to their current commit SHA (tag kept as comment)
• Add permissions: {} at workflow level and grant minimum scopes per job
  • crawl: contents: read
  • lint: contents: read
  • release-chart: packages: write
  • release: contents: write
  • test_and_publish_docker_image: contents: read for test, packages: write for build/push