ci: pin actions to commit SHAs and narrow workflow permissions

Actions referenced by tag are pinned to the commit the tag points at today, the
workflow token is read-only unless a job needs more, and checkout no longer
leaves credentials behind where no later step uses them. Dependabot keeps the
pins moving. No change to what the workflows do.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01CaQrWx6zTzc6GBwwm7PYXQ

Author: chengzeyi

.github/dependabot.yml

@@ -0,0 +1,7 @@
+version: 2
+updates:
+  # Actions are pinned to commit SHAs; this keeps the pins moving.
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: weekly

.github/workflows/pre-commit.yml

@@ -19,6 +19,8 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4
+      with:
+        persist-credentials: false
     - name: Setup Node.js
       uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
       with: