[LOW] Pin workflow actions and restrict CI permissions

[OskarEichler]

Summary

Pins every third-party action used by the active CI and CodeQL workflows to its current immutable commit, and makes the workflows' token permissions explicit.

Security impact

LOW: mutable action tags can be retargeted upstream, while pull-request CI executes repository-controlled code with the workflow token's implicit permissions. The patch pins the existing action versions without upgrading them, grants normal CI only contents: read, and keeps CodeQL's required security-events: write alongside explicit contents: read.

Pinned revisions:

• actions/checkout@v7 → 3d3c42e5aac5ba805825da76410c181273ba90b1
• ruby/setup-ruby@v1 → 95ef2b042f9d7a56d8268cba8559e2842e2ad01b
• github/codeql-action@v4.37.4 → f205ea1c3313d32999d8d6a48b4f6530d4437b38

Verification

• Resolved all three commits through the GitHub API.
• Parsed both changed workflows and Dependabot configuration as YAML.
• Verified every active workflow uses: reference is a full 40-character commit SHA.
• bundle exec rake spec:unit: 874 examples, 0 failures, 2 expected pending.
• bundle exec standardrb: 175 files, no offenses.
• Built the 4.24.0 gem: 109 entries, with no absolute or parent-traversal paths.
• git diff --check passes.

All Ruby-backed checks used Ruby 4.0.6 through rbenv.

Limitations

This does not update action versions or change gem runtime code. Dependabot remains configured to propose GitHub Actions updates.

Breaking changes

None.