* CI: reduce default permissions to minimum
* CI: update pin actions
Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.
* CI: make use of archive: false in upload-artifact
also set compression level and error behavior for scan-build upload.
* CI: update codeql and enable scanning actions
* CI: fix and more greedy filtering
* CI: only run lint if *.py changed
* CI: only run CodeQL if supported file changed
* CI: fix unittests still triggering for build.yml
* CI: update CodeQL action
* CI: trigger codeql when changing the workflow