Remediate security scan finding

[kn-ms]

Bug / Requirement Description

Clearly and concisely describe the problem.

actions consume github and other 3rd party actions with version tag. Best practice say consume it with the fixed hash.

Also set default permission to content read where we need to use some more powerfull permissions for some jibs.

Solution description

• pin actions versions
• limit permissions

Checklist:

• Test
• Example (both test_plan.py and .rst)
• Documentation (API)
• News fragment present for release notes
• MS info leakage check
• For new driver: driver index page
• For new assertion: ui/pdf/std renderers, documentation
• For new cmdline arg: documentation