Follow the recent compromise of tj-actions/changed-files, this PR pins GitHub actions to specific commit hashes to ensure a known version of each action is used, mitigating the risk of a supply chain attack through malicious updates.

See related blog post by rafaelgss about pinning to the commit-hash.

This PR also:

• Removes Git credentials after checkout as a security precaution by setting persist-credentials to false. They are not used after the initial checkout, and this stops them from accidentally leaking through a script; see related GitHub security post and related actions/checkout issue
• Declares the minimum permissions for the workflows to run at the workflow and job level, following principle of least privilege; see related GitHub security post