* CI: reduce default permissions to minimum
* CI: update pin actions
Most of them. CodeQL and action-gh-release is untouched for now.
Immutable actions and actions/* are pinned to version,
other actions are pinned to hash.
* CI: make use of archive: false in upload-artifact
also set compression level and error behavior for scan-build upload.
* CI: update codeql and enable scanning actions