Caps GITHUB_TOKEN's blast radius. None of these workflows need any
GitHub API write scope — they only push to Docker Hub — so the safest
default is permissions: {}, matching the posture used by AsamK/signal-cli.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Follow-up to #838: actions/checkout was the only third-party action
left on a mutable ref (@master). Pin it to v6.0.2's commit SHA, matching
the pattern used for docker/setup-qemu-action, docker/setup-buildx-action,
and docker/login-action.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>