ci: use zizmor to prevent supply chain attacks via GHA (#1518)

.github/workflows/codeql-analysis.yml

@@ -9,6 +9,9 @@ on:
   schedule:
     - cron: '0 17 * * 2'
 
+permissions:
+  contents: read
+
 jobs:
   analyze:
     name: Analyze
@@ -26,13 +29,14 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v6
+      uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
       with:
         fetch-depth: 2
+        persist-credentials: false
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v4
+      uses: github/codeql-action/init@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
       with:
         languages: ${{ matrix.language }}
 
@@ -43,6 +47,6 @@ jobs:
         make -j $(nproc) check
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v4
+      uses: github/codeql-action/analyze@dd677812177e0c29f9c970a6c58d8607ae1bfefd # v4
       with:
         category: "/language:${{matrix.language}}"