Security: Pin action SHAs and add explicit permissions

[CybotTM]

Summary

• Pin all GitHub Actions to full commit SHAs (not tags) for enhanced security
• Add explicit permissions block to CodeQL workflow
• Maintain existing permissions in other workflows

Changes

docker-build-push.yml

• Pin actions/checkout@v6 to SHA 8e8c483db84b4bee98b60c0593521ed34d9990e8
• Pin docker/setup-buildx-action@v3 to SHA e468171a9de216ec08956ac3ada2f0791b6bd435
• Pin docker/login-action@v3 to SHA 5e57cd118135c172c3672efd75eb46360885c0ef
• Pin docker/metadata-action@v5 to SHA c299e40c65443455700f0fdfc63efafe5b349051
• Pin docker/build-push-action@v6 to SHA 263435318d21b8e681c14492fe198d362a7d2c83
• Pin actions/attest-build-provenance@v3 to SHA 43d14bc2b83dec42d39ecae14e916627a18bb661

codeql-analysis.yml

• Pin actions/checkout@v6 to SHA 8e8c483db84b4bee98b60c0593521ed34d9990e8
• Pin github/codeql-action/init@v4 to SHA 27fcff4ecb39e96348e7ceddcc2d9ef42308b6fc
• Pin github/codeql-action/autobuild@v4 to SHA 27fcff4ecb39e96348e7ceddcc2d9ef42308b6fc
• Pin github/codeql-action/analyze@v4 to SHA 27fcff4ecb39e96348e7ceddcc2d9ef42308b6fc
• Add explicit permissions block (contents: read, security-events: write, actions: read)

auto-merge-deps.yml

• No changes needed (already has explicit permissions block, no actions to pin)

Security Benefits

1. Immutable References: Full SHA commits cannot be changed, preventing supply chain attacks
2. Explicit Permissions: Following principle of least privilege with minimal required permissions
3. Audit Trail: SHA comments preserve version information for maintainability

Test Plan

• Verify workflows pass syntax validation
• Confirm Docker build workflow executes successfully
• Ensure CodeQL analysis completes without errors
• Check auto-merge workflow still functions for dependabot/renovate PRs