[LOW] Pin workflow actions and restrict token permissions

[OskarEichler]

Summary

Pin both third-party workflow actions to immutable commits and set the workflow token's default permission to read-only repository contents.

Security impact

The current workflow executes mutable actions/checkout@v6 and ruby/setup-ruby@v1 references on pushes and pull requests while inheriting GitHub's ambient token permissions. If either mutable reference moves unexpectedly or its upstream release channel is compromised, changed code runs with whatever access the repository default grants.

This change preserves the human-readable major tags in comments while making the executed revisions immutable:

• actions/checkout v6: d23441a48e516b6c34aea4fa41551a30e30af803
• ruby/setup-ruby v1: 95ef2b042f9d7a56d8268cba8559e2842e2ad01b

Verification

• Both references resolve to the current upstream revisions for their configured release channels.
• Workflow YAML parses successfully.
• Every uses: entry is commit-pinned.
• git diff --check passes.
• actionlint was not available locally; GitHub Actions remains the authoritative workflow execution check.

Compatibility

No gem runtime or package behavior changes. Future action updates must deliberately update the pinned SHA.

[grosser]

the permissions is fine ... but I'm not pinning commits to commonly used public actions

[grosser]

#392