chore(ci): harden GitHub Actions workflows (pin SHAs, persist-credentials, permissions)

[tobyhede]

Repo-wide CI hardening, deferred from the #239 review (CodeRabbit / zizmor lints).

The PR review flagged the new codegen job in .github/workflows/test-eql.yml, but all four jobs share the same unpinned actions and the workflow has no permissions: block, so fixing only the new job would leave the workflow internally inconsistent. Track here, do it once, apply repo-wide.

Scope

In .github/workflows/test-eql.yml, jobs schema, codegen, test, splinter:

1. Pin actions/checkout@v6 to a 40-char commit SHA (lines 38, 60, 95, 130).
2. Pin jdx/mise-action@v4 to a 40-char commit SHA (lines 40, 62, 97, 132).
3. Pin Swatinem/rust-cache@v2 to a SHA where used (lines 46, 103).
4. Add with: persist-credentials: false to every actions/checkout step. None of the jobs git push, so this is safe.
5. Add a workflow-level permissions: contents: read block. None of the jobs write to the repo, create comments, or trigger other workflows.

Repeat the same review for any other workflows under .github/workflows/ (e.g. release-eql.yml) — write may genuinely be needed there (release artefacts), so scope per-job.

Follow-up

• Configure Dependabot for github-actions so SHA pins receive PR-driven bumps with the new tag in a trailing comment.

Lints / source

• zizmor: unpinned-uses, artipacked, excessive-permissions.
• PR feat: eql_v2_int4 variant family (v3) #239 review thread: feat: eql_v2_int4 variant family (v3) #239 (comment)