[4.2.x] Addressed unpinned-uses zizmor finding.

Backport of 86b8058b40 from main.

.github/workflows/check_commit_messages.yml

@@ -8,6 +8,9 @@ concurrency:
   group: ${{ github.workflow }}-${{ github.ref }}
   cancel-in-progress: true
 
+permissions:
+  contents: read
+
 jobs:
   check-commit-prefix:
     if: startsWith(github.event.pull_request.base.ref, 'stable/')

zizmor.yml

@@ -0,0 +1,6 @@
+rules:
+  unpinned-uses:
+    config:
+      policies:
+        actions/*: ref-pin
+        psf/*: ref-pin