CI(security): harden GitHub Actions workflows

[AlexV525]

Resolves zizmor findings in fluttercandies/security-scanner#13.

Hardens the GitHub Actions workflows against CI/CD supply-chain findings reported by zizmor.

Changes

.github/workflows/deploy-doc.yml

• unpinned-uses (High) — pinned the three previously moving-tag actions to immutable commit SHAs:
  • actions/checkout@v3 → @a37ce9120846195fa4ece8f58b268e6043cb2f26
  • peaceiris/actions-hugo@v2 → @dc99976453b04b1029527154fc04fef80a4a49cf
  • peaceiris/actions-gh-pages@v3 → @4a2e02b36f31d8974a0d09d3bb9f3172aa2d0d0d
• artipacked (Medium) — added persist-credentials: false to the actions/checkout step.
• excessive-permissions (Medium) — added a workflow-level permissions: contents: read (least-privilege). The deploy job retains its job-level permissions: contents: write, which it needs to push the gh-pages branch; the job-level scope correctly escalates over the read-only workflow default.

.github/workflows/analyze.yml

• artipacked (Medium) — added persist-credentials: false to all three actions/checkout steps (analyze, darwin, publishable jobs).
• (This workflow already declares permissions: {} at the workflow level, so no excessive-permissions change is required.)

Not addressed

• stale-action-refs (Low) — not remediated by design. These references are already pinned to commit SHAs (the secure pattern); the Low finding only notes that a SHA does not resolve to a release tag, which is not a security defect.

Validation

• Both modified workflow files parse as valid YAML (yaml.safe_load).
• Only files under .github/workflows/ were changed.