ci: pin containers to digest, enable more zizmor rules (#38779)

Enable more strict "pedantic" zizmor rules and fix issues. Service
containers are pinned to hash and renovate will update them. Enabled
rules:

- https://docs.zizmor.sh/audits/#excessive-permissions
- https://docs.zizmor.sh/audits/#unpinned-images
- https://docs.zizmor.sh/audits/#template-injection

---------

Signed-off-by: silverwind <me@silverwind.io>

.github/workflows/cron-licenses.yml

@@ -5,6 +5,8 @@ on:
   #   - cron: "7 0 * * 1" # every Monday at 00:07 UTC
   workflow_dispatch:
 
+permissions: {}
+
 jobs:
   cron-licenses:
     runs-on: ubuntu-latest