ci: pin actions to commit SHAs and declare workflow permissions (#13889)