fix(security): scope pipeline.yml permissions per-job instead of workflow-wide

[Copilot]

• Remove top-level permissions block from .github/workflows/pipeline.yml
• Add per-job permissions scoped to minimum required for each job:
  • auto-labeler: pull-requests: write, contents: read
  • createVersion: contents: write
  • lint: contents: read
  • testSource: contents: read
  • dockerBuild: packages: write, contents: read
  • dockerBuildAndPush: packages: write, contents: read
  • updateVersion: contents: read
• Updated workflow refs to pinned hashes (@07550bab80de7691f4947214ee342351896e209b) matching latest main

---

⚡ Quickly spin up Copilot coding agent tasks from anywhere on your macOS or Windows machine with Raycast.

[CLAassistant]

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ ntnn
❌ Copilot
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

[ntnn]

@copilot rebase

[Copilot]

@copilot rebase

Done. Incorporated the pinned workflow refs (@07550bab80de7691f4947214ee342351896e209b) from main along with the per-job permissions in commit 230a035.