[StepSecurity] ci: Harden GitHub Actions (#488)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

.github/workflows/postgresql-15-build.yml

@@ -7,6 +7,9 @@ on:
     tags:
       - '[0-9]+.[0-9]+.[0-9]+*'
 
+permissions:
+  contents: read
+
 jobs:
   build:
     name: pg-15-build-test
@@ -14,7 +17,7 @@ jobs:
     timeout-minutes: 30
     steps:
       - name: Clone postgres repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           repository: 'postgres/postgres'
           ref: 'REL_15_STABLE'
@@ -80,7 +83,7 @@ jobs:
           pg_ctl -D /opt/pgsql/data -l logfile start
 
       - name: Clone pg_stat_monitor repository
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
         with:
           path: 'src/pg_stat_monitor'
 
@@ -115,7 +118,7 @@ jobs:
 
       - name: Upload logs on fail
         if: ${{ failure() }}
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         with:
           name: Regressions diff and postgresql log
           path: |
@@ -137,7 +140,7 @@ jobs:
         run: make installcheck-world
 
       - name: Report on installcheck-world test suites fail
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
         if: ${{ failure() }}
         with:
           name: Regressions output files of failed testsuite, and pg log