Harden GitHub workflows

[samdark]

Summary

• Pin reusable yiisoft/actions workflows to a commit SHA.
• Set read-only GITHUB_TOKEN permissions for read-only workflows.

Validation

• zizmor --no-progress --no-exit-codes requirements/.github/workflows

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 15.38%. Comparing base (e66c731) to head (c96c9f5).

Additional details and impacted files

@@            Coverage Diff            @@
##             master      #93   +/-   ##
=========================================
  Coverage     15.38%   15.38%           
  Complexity       59       59           
=========================================
  Files             4        4           
  Lines           455      455           
=========================================
  Hits             70       70           
  Misses          385      385           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.