Lock down GitHub Actions Security

[briansmith]

Do for webpki what we propose for ring in briansmith/ring#1256.

Over the weekend, I merged PR #225 which minimizes the permissions of the GitHub token, and did the same for ring. I also changed the default permission of the GitHub token from read-write to read-only in the repository settings, but I don't think people can see this.

Now we still need to follow the (rest of the) guidance in https://docs.github.com/en/actions/learn-github-actions/security-hardening-for-github-actions to lock down our CI/CD.

Further, we need to ensure that all the dependencies of webpki have implemented that guidance.

Further, we need to extend our CI/CD to ensure that no new dependencies without such hardening are added as dependencies of webpki.