security(ci): SHA-pin actions + add permissions blocks (F-014/F-015)

- F-014 (CTO-4862): pin every GitHub Actions 'uses:' to a 40-char commit SHA
  (9 refs across 6 workflows), original tag kept as a comment.
- F-015 (CTO-4863): add top-level 'permissions: contents: read' to the five
  workflows lacking one (semgrep already had it).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: KrishnaSuravarapu

.github/workflows/commitlint.yml

@@ -1,10 +1,13 @@
 name: Check Commit Messages with Commitlint
 on: [pull_request]
+permissions:
+  contents: read
+
 jobs:
   commitlint:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
       with:
         fetch-depth: 0
-    - uses: wagoid/commitlint-github-action@v5
+    - uses: wagoid/commitlint-github-action@9763196e10f27aef304c9b8b660d31d97fce0f99 # v5

.github/workflows/config-validator.yml

@@ -1,10 +1,13 @@
 # github action to run commit-msg hook on pull request commits and push commits to master branch
 name: Validate sample config
 on: pull_request
+permissions:
+  contents: read
+
 jobs:
   config-validator:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Run config-validator
       run: python scripts/validator.py config.json.sample

.github/workflows/docker-push.yml

@@ -4,19 +4,22 @@ on:
     tags:
     - v*
 
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
     - name: Check out the repo
-      uses: actions/checkout@v3
+      uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Set up QEMU
-      uses: docker/setup-qemu-action@v2
+      uses: docker/setup-qemu-action@2b82ce82d56a2a04d2637cd93a637ae1b359c0a7 # v2
     - name: Set up Docker Buildx
-      uses: docker/setup-buildx-action@v2
+      uses: docker/setup-buildx-action@885d1462b80bc1c1c7f0b00334ad271f09369c55 # v2
     - name: Docker metadata
       id: meta
-      uses: docker/metadata-action@v4
+      uses: docker/metadata-action@818d4b7b91585d195f67373fd9cb0332e31a7175 # v4
       with:
         images: |
           browserstack/enigma
@@ -25,12 +28,12 @@ jobs:
           type=semver,pattern=v{{major}}.{{minor}}
           type=semver,pattern=v{{major}}
     - name: Login to DockerHub
-      uses: docker/login-action@v2
+      uses: docker/login-action@465a07811f14bebb1938fbed4728c6a1ff8901fc # v2
       with:
         username: ${{ secrets.DOCKERHUB_USERNAME }}
         password: ${{ secrets.DOCKERHUB_TOKEN }}
     - name: Build and push
-      uses: docker/build-push-action@v4
+      uses: docker/build-push-action@0a97817b6ade9f46837855d676c4cca3a2471fc9 # v4
       with:
         context: .
         push: true

.github/workflows/pre-commit.yml

@@ -1,11 +1,14 @@
 # github action to run commit-msg hook on pull request commits and push commits to master branch
 name: Pre Commit Hook
 on: [pull_request]
+permissions:
+  contents: read
+
 jobs:
   commit-msg-hook:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Run commit-msg hook
       run: |
         pip install pre-commit==2.21.0

.github/workflows/semgrep.yml

@@ -21,5 +21,5 @@ jobs:
       image: returntocorp/semgrep:1.166.0
     if: (github.actor != 'dependabot[bot]')
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
     - run: semgrep --error --config "p/cwe-top-25" --config "p/owasp-top-ten" --config "p/r2c-security-audit"

.github/workflows/unit-tests.yml

@@ -1,15 +1,18 @@
 name: Unit Tests and Lint
 on: [push]
+permissions:
+  contents: read
+
 jobs:
   build:
     runs-on: ubuntu-latest
     strategy:
       matrix:
         python-version: ['3.9', '3.10', '3.11']
     steps:
-    - uses: actions/checkout@v3
+    - uses: actions/checkout@f43a0e5ff2bd294095638e18286ca9a3d1956744 # v3
     - name: Set up Python ${{ matrix.python-version }}
-      uses: actions/setup-python@v4
+      uses: actions/setup-python@7f4fc3e22c37d6ff65e88745f38bd3157c663f7c # v4
       with:
         python-version: ${{ matrix.python-version }}
     - name: Install dependencies