ci(workflows): pin actions to hashes and restrict token permissions

[LinXunFeng]

Related Issues

• [CI/CD Security] fluttercandies/flutter_scrollview_observer - Issue Report security-scanner#24

Description

zizmor reports 8 high and 6 medium findings on the three workflows. This PR
clears all of them.

unpinned-uses / ref-confusion - every action is referenced by a mutable
tag. Pin them to commit hashes, keeping the version as a trailing comment:

actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
subosito/flutter-action@1a449444c387b1966244ae4d4f8c696479add0b2 # v2.23.0
peaceiris/actions-gh-pages@373f7f263a76c20808c831209c920827a82a2847 # v3.9.3
pozil/auto-assign-issue@65947009a243e6b3993edeef4e64df3ca85d760c # v1.14.0

Each one is the latest release of the major version already in use, so no
behaviour changes.

excessive-permissions - no workflow declares a permissions block, so the
jobs fall back to the default token scope. Declare permissions: {} at the
workflow level and keep only what each job actually needs: issues: write for
assign-issue, contents: write for deploy, contents: read for code-analysis.

artipacked - actions/checkout persists the token in .git/config by
default. None of these workflows push through it, so set
persist-credentials: false. The gh-pages deploy authenticates with its own
github_token input and is unaffected.

Verification

Locally with zizmor v1.29.0:

before: 25 findings - 8 high, 6 medium
after:  No findings to report. Good job! (9 suppressed)

--persona=pedantic also reports 0 high and 0 medium. The remaining
informational and low findings there (concurrency-limits,
undocumented-permissions) are pedantic-only audits and are left alone.