ci: fix code scanning alerts

[rootulp]

Summary

• Add permissions: contents: read to lint.yml, go.yml, and buf-release.yml to follow least-privilege principle for GITHUB_TOKEN
• Pin all 3rd-party GitHub Actions to commit SHAs (with tag comments for readability) across all 4 workflow files
• Resolves all 12 open CodeQL code scanning alerts (Add test-coverage reporting to github actions #5, Move underlying tree library into org or into internal package #6, Consider removing abstractions in favour of clarifying requirements to data serialization #7, Add possibility to store nodes of the tree (MapStore) #9, Optionally ignore max namespace ID #10, remove obsolete method Data.NamespaceSize #11, updated readme so that the example compiles #12, Work around the panic thrown by IntervalDigestFromBytes #20, Define String representation of IntervalDigest #21, Remove panic from IntervalDigestFromBytes #22, Computing leaf node hash must include namespace ID #23, Create a rsmt2d.Tree interface wrapper for NamespacedMerkleTree #24)

Test plan

• CI workflows still pass (no functional changes, only permissions and ref pinning)
• Verify code scanning alerts move to "fixed" state after merge

🤖 Generated with Claude Code

[gemini-code-assist]

Note

Gemini is unable to generate a review for this pull request due to the file types involved not being currently supported.