security: Add permissions blocks to workflows, pin codecov action

- Add 'permissions: contents: read' to build.yml, lint.yml, test.yml
- Add 'permissions: contents: write' to version.yml (needs write for tags)
- Pin codecov/codecov-action to commit hash v4.5.0

Author: lukekim

.github/workflows/build.yml

@@ -12,6 +12,9 @@ on:
       - v*
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   Build:
     runs-on: ${{ matrix.os }}

.github/workflows/lint.yml

@@ -11,6 +11,9 @@ on:
     tags:
       - v*
 
+permissions:
+  contents: read
+
 jobs:
   lint-ruff:
     runs-on: ubuntu-latest

.github/workflows/test.yml

@@ -13,6 +13,9 @@ on:
 
   workflow_dispatch:
 
+permissions:
+  contents: read
+
 jobs:
   test_pip_install:
     runs-on: ubuntu-latest
@@ -157,7 +160,7 @@ jobs:
           pytest --cov=spicepy --cov-report=xml --cov-report=term-missing --ignore=tests/test_main.py tests/
       - name: Upload coverage to Codecov
         if: matrix.python-version == '3.12'
-        uses: codecov/codecov-action@v4
+        uses: codecov/codecov-action@18283e04ce6e62d37312384ff67231eb8fd56d24  # v4.5.0
         with:
           files: ./coverage.xml
           fail_ci_if_error: false

.github/workflows/version.yml

@@ -8,6 +8,9 @@ on:
       - 'setup.py'
   workflow_dispatch:
 
+permissions:
+  contents: write
+
 jobs:
   check-and-extract:
     runs-on: ubuntu-latest