chore: harden GitHub Actions workflows

[hiddeco]

• Pin actions to SHAs.
• Set permissions on all workflows.

[netlify]

✅ Deploy Preview for docs-kargo-akuity-io ready!

Name	Link
🔨 Latest commit	7d439b1
🔍 Latest deploy log	https://app.netlify.com/sites/docs-kargo-akuity-io/deploys/66b9bb93e7f8f3000828eb43
😎 Deploy Preview	https://deploy-preview-2394.kargo.akuity.io
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.42%. Comparing base (a01f049) to head (7d439b1).
Report is 14 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #2394      +/-   ##
==========================================
+ Coverage   47.63%   48.42%   +0.78%     
==========================================
  Files         244      245       +1     
  Lines       17396    17715     +319     
==========================================
+ Hits         8287     8578     +291     
- Misses       8698     8719      +21     
- Partials      411      418       +7     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.