Harden actions

[tmakinen]

• Pin external actions to commit hash instead of version tag which is not immutable
• Enable dependabot for external actions
• Don't keep git credentials on filesystem after checkout
• Remove all permissions from workflow and assign minmal permissions at job level
• Use gh release command directly instead of external action