F-43: CI hardening #46

Severity: LOW · Effort: Small · Batch: 5 · Status: Done in #21 (c472b03); CI passed with the pins. Closes when #21 merges

Found in the second full review of the firmware. Recorded with the rest of the pass (F-19…F-44) in docs/REVIEW_REMEDIATION_PLAN_2.md, which is where its status is kept.

No permissions: block, actions pinned by tag rather than SHA, and
espressif/esp_websocket_client: '*' in the manifest (the lock file pins it).

Acceptance Criteria

• permissions: contents: read at the top of ci.yml.
• actions/checkout, espressif/esp-idf-ci-action and actions/upload-artifact are
  pinned by commit, each with its release in a comment. esp-idf-ci-action@v1 turned out
  to be a branch; it is pinned at the head @v1 was running.
• esp_websocket_client is ~1.8.0, and dependencies.lock's manifest_hash is
  recomputed to match, so CI does not re-solve.
• CI passes on the PR with the pins (bf65c15). The log shows the three pinned commits
  downloaded, and the component manager taking the lock as it is, with no re-solve.
• Pinned actions no longer update themselves. Dependabot's github-actions ecosystem would
  raise the bumps, if wanted.