Pin GitHub Actions to commit SHAs and harden CI workflows

[mfridman]

This PR pins all GitHub Actions to commit SHAs and does some light hardening of the CI workflows.

• pins every action to a SHA, keeping the # vX.Y.Z comments so Dependabot can still bump them
• adds permissions: contents: read to the build and lint workflows (spell-check and CodeQL already scoped theirs)
• sets persist-credentials: false on every checkout, since none of the workflows push
• pins golangci-lint to a fixed version instead of latest, so an upstream release can't break CI unexpectedly
• adds PR-scoped concurrency to build and lint to cancel superseded runs
• bumps typos from v1.46.0 to v1.48.0

All actions are on their latest major version.