Pin actions to hash instead of version, also default all permissions …

[drewroengoogle]

Pins all actions to a specific hash, also defaults permissions to readonly. This resolves a significant amount of code scanning security vulnerabilities, such as:

• https://github.com/flutter/gallery/security/code-scanning/28
• https://github.com/flutter/gallery/security/code-scanning/27
• https://github.com/flutter/gallery/security/code-scanning/26
• https://github.com/flutter/gallery/security/code-scanning/21
• https://github.com/flutter/gallery/security/code-scanning/20
• https://github.com/flutter/gallery/security/code-scanning/19
• https://github.com/flutter/gallery/security/code-scanning/17
• https://github.com/flutter/gallery/security/code-scanning/16
• https://github.com/flutter/gallery/security/code-scanning/15
• https://github.com/flutter/gallery/security/code-scanning/14
• https://github.com/flutter/gallery/security/code-scanning/13
• https://github.com/flutter/gallery/security/code-scanning/12
• https://github.com/flutter/gallery/security/code-scanning/11
• https://github.com/flutter/gallery/security/code-scanning/10
• https://github.com/flutter/gallery/security/code-scanning/9
• https://github.com/flutter/gallery/security/code-scanning/8
• https://github.com/flutter/gallery/security/code-scanning/7
• https://github.com/flutter/gallery/security/code-scanning/6
• https://github.com/flutter/gallery/security/code-scanning/5
• https://github.com/flutter/gallery/security/code-scanning/4
• https://github.com/flutter/gallery/security/code-scanning/3

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I read the Tree Hygiene wiki page, which explains my responsibilities.
• I read the Flutter Style Guide recently, and have followed its advice.
• I signed the CLA.
• I listed at least one issue that this PR fixes in the description above.
• I updated/added relevant documentation (doc comments with ///).
• I added new tests to check the change I am making, or this PR is test-exempt.
• All existing and new tests are passing.

If you need help, consider asking for advice on the #hackers-new channel on Discord.