chore(ci): address all lint findings (#206)

This addresses a variety of findings, mostly around overly broad default
permissions and credential sharing.

I've also run [pinact](https://github.com/suzuki-shunsuke/pinact) to
auto-hash-pin all action references -- Dependabot will still update
these, but having them hash-pinned will seal off any undesirable
tag/branch mutability 🙂

(99% of these findings were done automatically with `zizmor --fix=all`,
followed by verifying the results. I haven't added a
[zizmor](https://docs.zizmor.sh) workflow as part of this PR, but I'd be
happy to if desired.)

---------

Signed-off-by: William Woodruff <william@astral.sh>

.github/workflows/release-drafter.yml

@@ -17,6 +17,6 @@ jobs:
       pull-requests: read
     steps:
       - name: 🚀 Run Release Drafter
-        uses: release-drafter/release-drafter@v6.1.0
+        uses: release-drafter/release-drafter@b1476f6e6eb133afa41ed8589daba6dc69b4d3f5 # v6.1.0
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}