build: SHA-pin GitHub Actions for supply-chain security

[jimisola]

Summary

Pin GitHub Actions to exact commit SHAs instead of floating branch/tag references:

• reqstool/.github/...@main → SHA-pinned to current main commit

🤖 Generated with Claude Code

To fix the problem, add an explicit permissions block that grants only the minimal privileges needed for this workflow. Since this workflow only delegates to a reusable workflow that checks PR titles (a read-only operation in most setups), the conservative and generally correct choice is to set contents: read at the workflow root so it applies to all jobs, including the check job. This follows GitHub’s recommendation for least-privilege defaults and satisfies CodeQL’s requirement that permissions be explicit.

Concretely, in .github/workflows/check-semantic-pr.yml, insert a permissions: section after the on: block (for example after line 6–7) with contents: read. This will ensure GITHUB_TOKEN is limited to read-only access to repository contents for this workflow. No imports or additional methods are required, as this is purely a YAML configuration change. Existing functionality (reusing the external workflow) will continue to work, as such semantic checks typically do not need write permissions.