fix(ci): add read permissions and pin checkout actions

Add the missing `permissions: contents: read` configuration to workflows
and pin the `actions/checkout` step to a specific commit hash for security
consistency with other Firebase repositories.

.github/workflows/spm.yml

@@ -1,5 +1,8 @@
 name: spm
 
+permissions:
+  contents: read
+
 on:
   push:
   pull_request:
@@ -8,7 +11,7 @@ jobs:
   swift-build-run:
     runs-on: macOS-latest
     steps:
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
     - name: Build
       run: swift build
     - name: Run

.github/workflows/tests.yml

@@ -1,4 +1,8 @@
 name: Test after code changes
+
+permissions:
+  contents: read
+
 on:
   workflow_dispatch:
   push:
@@ -29,7 +33,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
 
@@ -51,7 +55,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
           fetch-depth: "0"
@@ -73,7 +77,7 @@ jobs:
 
     steps:
       - name: Check out code from GitHub
-        uses: actions/checkout@v2
+        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
         with:
           path: nanopb
           fetch-depth: "0"