CI: Harden GHA configuration

[tacaswell]

Apply recommended hardening steps including:

• pinning to a SHA any actions used
• not persisting the read token on checkout
• setting the default permissions
• adding a depandabot file for GHA

[tacaswell]

I apparently forgot to pull main before doing this, working on it.

[molinav]

Thanks for the contribution, @tacaswell! I was looking at the workflow attempt for this PR:
https://github.com/matplotlib/basemap/actions/runs/16377453139

The workflow could not start with the following error message:

Invalid workflow file: .github/workflows/build.yml#L2](https://github.com/matplotlib/basemap/actions/runs/16377453139/workflow)
The workflow is not valid. .github/workflows/build.yml (Line: 2, Col: 3): Unexpected value 'content'

It refers to the first code block added at the top of .github/workflows/build.yml:

basemap/.github/workflows/build.yml

Lines 1 to 2 in 93310cc

	permissions:
	content: read

Something in this code block seems to need some syntax change (I do not have the knowledge for this global use of permissions).

[molinav]

I was looking briefly at other similar merged PRs in the matplotlib ecosystem:
https://github.com/matplotlib/matplotview/pull/8/files
https://github.com/matplotlib/mpl-gui/pull/22/files

It seems to me it is just a typo, so it should be contents instead of content. Is this correct?