ci: pin actions to latest stable SHAs and narrow permissions in test workflow

zizmor flagged unpinned action references and overly broad read-all
permissions. Pin all actions to their latest stable release commit SHAs
(checkout v7.0.1, setup-python v7.0.0, setup-uv v10.1.0) and scope
permissions to contents:read per job.

.github/workflows/test.yml

@@ -6,18 +6,20 @@ on:
   pull_request:
     branches: [master]
 
-permissions: read-all
+permissions: {}
 
 jobs:
   lint:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-python@v5
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Install uv
-        uses: astral-sh/setup-uv@v4
+        uses: astral-sh/setup-uv@bec219d24cd3e171d82865faccec33120bb574f4  # v10.1.0
       - name: Lint with ruff
         run: |
           uvx ruff check
@@ -25,11 +27,13 @@ jobs:
 
   test:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
         with:
           submodules: recursive
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97  # v7.0.0
         with:
           python-version: "3.13"
       - name: Install dependencies