defense-in-depth improvements to GitHub actions workflows

[bobcallaway]

these are defense-in-depth improvements on your CI workflows:

• actions refs are pinned by hash instead of by floating version tags
• git credentials (containing the GITHUB_TOKEN) are not persisted in the local workspace when the code is checked out
• default read-only permissions are codified at the top level of the workflows, adhering to the principle of least privilege

it would be good to also configure dependabot to keep these actions up to date, but I can do that in a separate PR if you'd like.

[xorptr]

Thank you for updating the configs!

Review summary:

• LGTM for limiting permissions. As per documentation, this should limit github token permissions
• LGTM for clang-format workflow update. The commit hash is correct for v4.18.0
• I don't see v7.0.0 for checkout workflow in releases. It jumps from v6.1.0 to v7.0.1. The tags show v7 and v7.0.1 with commit hash 3d3c42e5aac5ba805825da76410c181273ba90b1. Could you please confirm if we should use that commit?
• LGTM for adding persist-credentials: false. Looking around, it seems good to have it (based on this random blog post)

[bobcallaway]

Thank you for updating the configs!

Review summary:

• LGTM for limiting permissions. As per documentation, this should limit github token permissions
• LGTM for clang-format workflow update. The commit hash is correct for v4.18.0
• I don't see v7.0.0 for checkout workflow in releases. It jumps from v6.1.0 to v7.0.1. The tags show v7 and v7.0.1 with commit hash 3d3c42e5aac5ba805825da76410c181273ba90b1. Could you please confirm if we should use that commit?
• LGTM for adding persist-credentials: false. Looking around, it seems good to have it (based on this random blog post)

https://github.com/actions/checkout/releases/tag/v7.0.0 does exist (it was on page 2 for me), but i just bumped it to v7.0.1 for you

[xorptr]

Rebased commits on top of latest changes