chore(ci): add explicit permissions and pin GitHub Actions to specific versions

[JasperSui]

Security Improvements for GitHub Actions Workflows

This PR includes security improvements for our GitHub Actions workflows:

Changes

1. Added explicit permissions to all workflow files:

   • labeler.yml: Added read/write permissions for contents, issues, and pull requests
   • release.yml: Added write permissions for contents and id-token
   • tests.yml: Added read permissions for contents/actions and write for checks

2. Pinned all GitHub Actions to specific commit hashes for better security:

   • actions/[email protected]
   • actions/[email protected]
   • salsify/[email protected]
   • pypa/[email protected]
   • release-drafter/[email protected]

Security Benefits

These changes follow GitHub's security best practices by:

• Using the principle of least privilege with explicit permissions
• Preventing supply chain attacks by pinning action versions to specific commit hashes
• Maintaining the same functionality while improving security posture

Testing

• Workflows have been tested to ensure they continue to function as expected
• All permissions are set to the minimum required levels for each workflow