ci: harden workflows — least-privilege permissions + SHA-pinned actions

.github/workflows/windows-test.yml

@@ -16,13 +16,16 @@ on:
       - 'src/aipass/drone/cli.py'
       - 'pyproject.toml'
 
+permissions:
+  contents: read
+
 jobs:
   windows-setup:
     runs-on: windows-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
-      - uses: actions/setup-python@v5
+      - uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6.2.0
         with:
           python-version: '3.12'
 
@@ -49,7 +52,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v7
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
         with:
           name: windows-pytest-results
           path: pytest-output.txt