ci: pin action SHAs, set permissions, and prevent template injection

[dkhawk]

Description

This PR hardens the repository's GitHub Actions workflows against security vulnerabilities identified by Zizmor and CI scans:

1. Explicit Permissions: Added top-level permissions: blocks to all workflow files (contents: read, security-events: write, pull-requests: write) following the principle of least privilege.
2. Immutable Action Pinning: Pinned all actions (actions/checkout, actions/setup-java, gradle/actions/setup-gradle, peter-evans/create-pull-request, github/codeql-action/upload-sarif, madrapps/jacoco-report, actions/upload-artifact, googleapis/release-please-action) to full commit SHA hashes with version comments.
3. Template Injection Prevention: Updated .github/workflows/test.yml to pass step outputs via env: variables instead of direct shell string interpolation (${{ steps.jacoco.outputs... }}).

---

📚 Stacked PR Chain

#	PR	Description	Base	Status
1	👉 #115	ci/workflow-security-hardening (Workflow permissions & action pinning)	main	✅ CI Passing
2	#116	test/library-coverage-baseline (Test suite reaching 93.8% coverage)	#115	✅ CI Passing
3	#117	build/dependency-modernization (AGP 9.3.2, Gradle 9.5.1, Places 5.3.0)	#116	✅ CI Passing
4	#119	feat/places-usage-attribution (Usage attribution & remove :library)	#117	✅ CI Passing
5	#118	demo/ux-edge-to-edge-polish (Demo UX, edge-to-edge, mock location)	#119	✅ CI Passing

Umbrella PR: #109

[googlemaps-bot]

Code Coverage

Overall Project	0%	❌

There is no coverage information present for the Files changed

[kikoso]

Do we need this permission?

[LoyalAbbas]

+1 for @kikoso question.

Currently, madrapps/jacoco-report on line 57 uses token: ${{ secrets.SYNCED_GITHUB_TOKEN_REPO }}. Since top-level permissions: only scope the default GITHUB_TOKEN, pull-requests: write has no effect as written.

Recommendation (Option A — Better Security):
Keep pull-requests: write and switch madrapps/jacoco-report on line 57 to use secrets.GITHUB_TOKEN instead of secrets.SYNCED_GITHUB_TOKEN_REPO:

        token: ${{ secrets.GITHUB_TOKEN }}
      

[dkhawk]

Updated! Switched madrapps/jacoco-report to use secrets.GITHUB_TOKEN instead of secrets.SYNCED_GITHUB_TOKEN_REPO, which properly utilizes the pull-requests: write permission while adhering to least privilege without exposing repository secrets.

[LoyalAbbas]

LGTM

[kikoso]

LGTM