ci: add read-only token permissions and pin all action references to SHAs

All CI workflows lacked a top-level permissions block, leaving each run
to inherit the repository default (potentially write-all). Each workflow
now has `permissions: read-all` at the top level.

Every action reference that used a mutable version tag was pinned to its
full commit SHA, preventing silent tag-rewriting supply-chain attacks.

Verified with zizmor --min-severity high: no findings after this patch.

Signed-off-by: Alb3e3 <tomaska.filip@gmail.com>

Author: ftmska

.github/workflows/autotools-cross-mips.yml

@@ -2,6 +2,8 @@ name: Autotools-cross-MIPS
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
 
  AutoMakeBuild:
@@ -60,7 +62,7 @@ jobs:
             cflags: -mips64r2 -mdsp,
           }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Install QEMU
         run:  sudo apt-get update && sudo apt-get install -y qemu-user
       - name: Install prebuilt toolchain

.github/workflows/autotools.yml

@@ -2,6 +2,8 @@ name: Autotools
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
 
  AutoMakeBuild:
@@ -36,7 +38,7 @@ jobs:
             buildconfig: --enable-assertions --enable-custom-modes --enable-dred --enable-osce
           }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         # No AutoMake on Mac so let's install it
       - name: Install AutoConf, AutoMake and LibTool on MacOSX
         if: matrix.config.os == 'macos-latest'

.github/workflows/cmake.yml

@@ -5,12 +5,14 @@ on: [push, pull_request]
 env:
   NDK_VERSION: 27.3.13750724
 
+permissions: read-all
+
 jobs:
   CMakeVersionTest:
     name: Test build with CMake 3.16.0
     runs-on: ubuntu-22.04
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Download models
@@ -40,7 +42,7 @@ jobs:
     name: CMake MINGW
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Download models
@@ -228,7 +230,7 @@ jobs:
           }
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install AutoConf, AutoMake and LibTool # Needed for autogen.sh

.github/workflows/dred.yml

@@ -6,6 +6,8 @@ on: [push, pull_request]
 env:
   NDK_VERSION: 27.3.13750724
 
+permissions: read-all
+
 jobs:
   CMakeBuild:
     name: CMake/${{ matrix.config.name }}
@@ -58,7 +60,7 @@ jobs:
             args: -G "Unix Makefiles" -DCMAKE_SYSTEM_NAME=iOS -DCMAKE_OSX_ARCHITECTURES=arm64
           }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install AutoConf, AutoMake and LibTool # Needed for autogen.sh
@@ -108,7 +110,7 @@ jobs:
             automakeconfig:
           }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Install AutoConf, AutoMake and LibTool on MacOSX

.github/workflows/makefile.yml

@@ -2,6 +2,8 @@ name: Makefile
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
 
  MakefileBuild:
@@ -17,7 +19,7 @@ jobs:
             compiler: gcc,
           }
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       - name: Build
         run: make -f Makefile.unix -j 2
       - name: Test

.github/workflows/repository.yml

@@ -2,12 +2,14 @@ name: Repository
 
 on: [push, pull_request]
 
+permissions: read-all
+
 jobs:
   CheckTrailingWhiteSpaces:
     name: Check trailing white spaces
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
         with:
           fetch-depth: 0
       - name: Check Whitespaces