fix: harden GitHub Actions workflows

[fzipi]

what

• pin fernandrone/linelint to commit SHA instead of mutable master branch
• add explicit permissions: contents: read to reusable lint and integration workflows

why

• fernandrone/linelint@master tracks a mutable branch — a compromised upstream could inject arbitrary code that runs in every plugin repo that uses this reusable workflow (~20 repos)
• this repo is the upstream reusable workflow for most CRS plugins, so hardening it has org-wide impact
• explicit permissions follow the principle of least privilege

refs

• GitHub docs: security hardening for GitHub Actions