Limit the workflow token, pin third-party actions and bump all actions to current

[vharseko]

Closes the 28 medium CodeQL alerts on the workflows: actions/missing-workflow-permissions (7 jobs) and actions/unpinned-tag (21 uses).

Token permissions

The repository's default GITHUB_TOKEN is read/write (default_workflow_permissions=write) and none of build.yml, deploy.yml, release.yml had a permissions block, so every job — including the PR builds — ran with a token that can push to the repository. Now:

Job	Needs	permissions
build-maven, build-docker*	checkout, artifacts, push to the job-local registry on localhost:5000	contents: read (workflow level)
deploy-maven	Maven Central via the OSSRH secrets, artifacts	contents: read (workflow level)
release-maven	mvn release:prepare pushes the release commits and tag through the checkout token; action-gh-release creates the release	contents: write
release-docker*	docker/login-action to GHCR with GITHUB_TOKEN, image push	contents: read, packages: write

codeql.yml already had its block. Only a real release exercises release-maven's contents: write — if release:prepare needs more than that, it will show on the first release; the change is one block to adjust.

Pinned and current

Third-party actions were used by moving major tags (docker/*@v4/v6/v7, softprops/action-gh-release@v2), so whoever can move a tag runs code in the release job next to the OSSRH, GPG and Docker Hub secrets. They are pinned to the commits of their current releases (# vX.Y.Z next to each), and all actions move to their latest majors:

Action	Before	After
docker/metadata-action	v6	dc802804… v6.2.0
docker/setup-qemu-action	v4	99012661… v4.4.0
docker/setup-buildx-action	v4	f87e5991… v4.4.1
docker/build-push-action	v7	c3c9e263… v7.4.0
docker/login-action	v4	dbcb8138… v4.6.0
softprops/action-gh-release	v2	efb35369… v3.0.3 — 3.0 only moves the runtime to Node 24, inputs unchanged
actions/checkout	v6	v7
actions/setup-java	v5	v6
actions/cache	v5	v6
actions/upload-artifact	v6	v7
github/codeql-action	v4	v4 (current major)

Checked the major-version notes: actions/checkout v7 refuses to check out fork PRs under workflow_run/pull_request_target — deploy.yml only checks out the repository's own branches on push, so it is unaffected; setup-java v6 switched the Zulu lookup to the Azul Metadata API and renamed jdkFile (not used here); the Node 24 runtimes need runner ≥ 2.327.1, which the GitHub-hosted runners have. First-party actions/* stay on major tags (the rule does not flag them; dependabot updates them as well).

.github/dependabot.yml (new) updates GitHub Actions weekly in one grouped PR, so the commit pins do not silently fall behind. deploy.yml gets the license header it was missing.

Release lookup in the Docker jobs

build-docker and build-docker-alpine fetched releases/latest with an anonymous curl. The anonymous limit is 60 req/h per IP and the IP is a shared runner's, so a rate-limited answer silently left release_version empty, metadata-action produced no tag, and buildx failed two steps later with tag is needed when pushing to registry (#140, run 35429703030 — build-docker-alpine only survived because it has a second literal tag). The step now uses gh release view with the workflow token (contents: read is enough), takes tagName — what the Dockerfile's releases/download/$VERSION/openicf-$VERSION.zip URL is built from; every release here has name == tagName — and fails the step itself with the last release: line when the value is empty.