Update GitHub Actions security (#28)

* Pin GitHub Actions to SHA

* Add permissions to reusable workflows

Author: danbarr

.github/workflows/_security-checks.yaml

@@ -3,6 +3,9 @@ name: Security checks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   trivy:
     name: Trivy scan

.github/workflows/_static-checks.yaml

@@ -3,6 +3,9 @@ name: Static checks
 on:
   workflow_call:
 
+permissions:
+  contents: read
+
 jobs:
   lint:
     name: Lint and format checks

.github/workflows/on-pr.yaml

@@ -14,4 +14,3 @@ jobs:
   static-checks:
     name: Static checks
     uses: ./.github/workflows/_static-checks.yaml
-    secrets: inherit