chore(ci): security hardening

[iota9star]

Resolves zizmor CI/CD security findings for .github/workflows/test.yml.

Closes fluttercandies/security-scanner#36

Changes:

• unpinned-uses (High): Pinned actions/checkout, dart-lang/setup-dart, codecov/codecov-action to commit SHAs with tag comments.
• artipacked (Medium): Added persist-credentials: false to actions/checkout.
• excessive-permissions (Medium): Added top-level permissions: contents: read.

[Copilot]

Pull request overview

This PR hardens the Dart CI workflow in .github/workflows/test.yml to address zizmor-reported CI/CD security findings by minimizing default GITHUB_TOKEN permissions and removing mutable action references.

Changes:

• Added explicit workflow-level permissions: contents: read to avoid excessive default token permissions.
• Pinned actions/checkout, dart-lang/setup-dart, and codecov/codecov-action to immutable commit SHAs (with tag comments for traceability).
• Disabled persisted Git credentials during checkout via persist-credentials: false.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.