CI: set permissions, update and pin actions, CodeQL for actions (#6073)

* CI: reduce default permissions to minimum

* CI: update pin actions

Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.

* CI: make use of archive: false in upload-artifact

also set compression level and error behavior for scan-build upload.

* CI: update codeql and enable scanning actions

.github/workflows/analyze-modified-files.yml

@@ -14,6 +14,8 @@ env:
   BEFORE: ${{ github.event.before }}
   AFTER: ${{ github.event.after }}
 
+permissions: {}
+
 jobs:
   flake8-or-mypy:
     strategy:
@@ -25,7 +27,7 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6.0.2
 
       - name: "Determine modified files (pull_request)"
         if: github.event_name == 'pull_request'
@@ -50,7 +52,7 @@ jobs:
         run: |
           echo "diff=." >> $GITHUB_ENV
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@v6.2.0
         if: env.diff != ''
         with:
           python-version: '3.11'