ci: Pin GHA to a full length commit SHA; add permissions; add CodeQL check#3577

FBruzzesi wants to merge 4 commits intomainnarwhals-dev/narwhals:mainfrom

chore/improve-openssfnarwhals-dev/narwhals:chore/improve-openssfCopy head branch name to clipboard