ci: pin actions workflow step hashes and use minimum permissions

[zimeg]

Summary

This PR uses the wonderful zizmor tool to audit our own workflows and pinact for pinned versioning 👾

Reviewers

A similar audit can be performed with the zizmor tool:

$ zizmor .
...
No findings to report. Good job! (2 suppressed)

The suppressed findings are expected permission blocks at the top-level of a workflow, but we set this for each job.

Requirements

• I've read and understood the Contributing guidelines and have done my best effort to follow them.
• I've read and agree to the Code of Conduct.

[zimeg]

🗣️ CI is failing for now due to unsupported ubuntu versions of the runner! Marking as a draft until further notice I hope the tests pass.

[zimeg]

@WilliamBergamin Soon now we will have the efforts across workflows in @slackapi projects complete I'm so hoping. Thanks for the review!