CI: set read-only token permissions and pin actions by SHA #1959

.github/workflows/ci.yml has no permissions: key, so GITHUB_TOKEN gets the repository default, and actions/checkout keeps its credentials. The actions are pinned to mutable tags (actions/checkout@v5, docker/setup-buildx-action@v4, docker/build-push-action@v7, actions/cache@v5), and the sagemath/sagemath:latest and debian:stable-slim images are unpinned; #1853 was a latest update breaking the sage job. Nothing is exploitable today: CI releases nothing, and no run: step reads pull request data.

Would you take a pull request that sets permissions: contents: read and persist-credentials: false, and pins actions and images by full SHA or digest with version comments?

Assisted-by: my usual tools (LLM, Internet, computer). Mistakes are mine.

Would you take a pull request that sets permissions: contents: read and persist-credentials: false, and pins actions and images by full SHA or digest with version comments?

Concept ACK

Some defense-in-depth hardening won't hurt here, in particular if it's as simple as adding a permission block with two entries. Workflow permissions are set to "Read repository contents and packages permissions" but it sounds like a good idea to make it explicit in the yaml (if only for forks).

But we should keep this in sync with whatever best practices Bitcoin Core applies here. cc @hebasto @fanquake