feat(ci): pin versions, tighten permissions

.github/workflows/security-metrics.yml

@@ -10,6 +10,11 @@ on:
   schedule:
     - cron: '0 0 * * 0' # Weekly
 
+permissions:
+  contents: read
+  actions: read
+  pull-requests: read
+
 jobs:
   collect-metrics:
     runs-on: ubuntu-latest
@@ -18,10 +23,10 @@ jobs:
       issues: write
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
 
       - name: Collect Metrics
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
         with:
           script: |
             const metrics = {