Update workflows for current Google project needs.

- Add permissions block.
- Switch to hashs over tags.

.github/workflows/bazel.yml

@@ -1,5 +1,8 @@
 name: Bazel
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]
@@ -33,8 +36,8 @@ jobs:
       matrix:
         MODE: ["dbg", "opt"]
     steps:
-      - uses: actions/checkout@v7
-      - uses: bazel-contrib/setup-bazel@0.19.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+      - uses: bazel-contrib/setup-bazel@104e3eea9447cdaa4b00d0fb46191a3985d26ab3 # 0.19.1
         with:
           bazelisk-cache: true
           repository-cache: true

.github/workflows/cocoapods.yml

@@ -1,5 +1,8 @@
 name: CocoaPods
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]
@@ -32,7 +35,7 @@ jobs:
         PLATFORM: ["ios", "macos", "tvos", "visionos", "watchos --skip-tests"]
         CONFIGURATION: ["Debug", "Release"]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     # Manually expanding out static frameworks to avoid making to many jobs.
     - name: Pod lib lint
       run:  |

.github/workflows/swiftpm.yml

@@ -1,5 +1,8 @@
 name: SwiftPM
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]
@@ -34,7 +37,7 @@ jobs:
       matrix:
         CONFIGURATION: ["debug", "release"]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Build and Test
       run:  |
         set -eu
@@ -51,7 +54,7 @@ jobs:
         PLATFORM: ["ios", "macos", "tvos", "visionos", "watchos"]
         CONFIGURATION: ["Debug", "Release"]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Build and Test
       run:  |
         set -eu

.github/workflows/test_apps.yml

@@ -1,5 +1,8 @@
 name: TestApps
 
+permissions:
+  contents: read
+
 on:
   push:
     branches: [ main ]
@@ -28,7 +31,7 @@ jobs:
         PLATFORM: ["macOS"]
         CONFIGURATION: ["Debug", "Release"]
     steps:
-    - uses: actions/checkout@v7
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
     - name: Build
       run:  |
         set -eu