security: pin dependencies and restrict token permissions #223

Job	Run time
Build and test on macOS (macos-latest)	1m 4s
Build and test on Windows (windows-11-arm)	3m 39s
Build and test Fedora on multiple runners (ubuntu-latest)	1m 31s
Build and test on Windows (windows-latest)	2m 40s
Build and test Fedora on multiple runners (ubuntu-24.04-arm)	1m 31s
Build and test on macOS (macos-26-intel)	2m 9s
Build and test makefile	56s
version-release	0s
	13m 30s

Provide feedback