Fix zizmor security issues in CI workflow

[felipediesel]

Fixes three zizmor audit findings:

• unpinned-uses: Pin all GitHub Actions to their commit SHAs instead of version tags
• excessive-permissions: Scope down contents: write to contents: read on the standard job; add explicit contents: read to the test job
• artipacked: Disable git credential persistence with persist-credentials: false in actions/checkout