Harden GitHub Actions permissions and pin Ubuntu runners (#218)

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

Author: Copilot

.github/workflows/luacheck.yml

@@ -16,12 +16,12 @@ on:
     branches:
     - master
 
+permissions: read-all
+
 jobs:
 
   luacheck:
-    runs-on: ubuntu-22.04
-    permissions:
-      contents: read
+    runs-on: ubuntu-24.04
     steps:
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1

.github/workflows/unix_build.yml

@@ -15,11 +15,11 @@ on:
     branches:
     - master
 
+permissions: read-all
+
 jobs:
   test:
-    permissions:
-      contents: read
-    runs-on: ubuntu-22.04
+    runs-on: ubuntu-24.04
 
     strategy:
       fail-fast: false