## Summary

This pull request is created by [Secure Repo](https://app.stepsecurity.io/securerepo) at the request of @meteorcloudy. Please merge the Pull Request to incorporate the requested changes. Please tag @meteorcloudy on your message if you have any questions related to the PR. You can also engage with the [StepSecurity](https://github.com/step-security) team by tagging @step-security-bot.

## Security Fixes

### Least Privileged GitHub Actions Token Permissions

The GITHUB_TOKEN is an automatically generated secret to make authenticated calls to the GitHub API. GitHub recommends setting minimum token permissions for the GITHUB_TOKEN.

- [GitHub Security Guide](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#using-the-github_token-in-a-workflow)
- [The Open Source Security Foundation (OpenSSF) Security Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#token-permissions)
### Pinned Dependencies

GitHub Action tags and Docker tags are mutatble. This poses a security risk. GitHub's Security Hardening guide recommends pinning actions to full length commit.

- [GitHub Security Guide](https://docs.github.com/en/actions/security-guides/security-hardening-for-github-actions#using-third-party-actions)
- [The Open Source Security Foundation (OpenSSF) Security Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)
### Harden Runner

[Harden-Runner](https://github.com/step-security/harden-runner) is an open-source security agent for the GitHub-hosted runner to prevent software supply chain attacks. It prevents exfiltration of credentials, detects tampering of source code during build, and enables running jobs without `sudo` access.

<details>
<summary>Harden runner usage</summary>

You can find link to view insights and policy recommendation in the build log

<img src="https://github.com/step-security/harden-runner/blob/main/images/buildlog1.png?raw=true" width="60%" height="60%">

Please refer to [documentation](https://docs.stepsecurity.io/harden-runner/getting-started#why-monitor-cicd-runtime) to find more details.
</details>

## Feedback
For bug reports, feature requests, and general feedback; please create an issue in [step-security/secure-repo](https://github.com/step-security/secure-repo). To create such PRs, please visit https://app.stepsecurity.io/securerepo

.

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

Closes #18264.

PiperOrigin-RevId: 528962586
Change-Id: I974154def6bccc58449012c5a698a8a0bac1276b

Following https://github.com/ossf/scorecard-action/#installation to enable OSSF Scorecards

Closes #18233.

PiperOrigin-RevId: 527542620
Change-Id: I6b31a2b9e82e260692252b6d3e8ec11e48bec59d