build: SHA-pin GitHub Actions for supply-chain security

[jimisola]

Summary

Pin GitHub Actions to exact commit SHAs instead of floating branch/tag references:

• reqstool/.github/...@main → SHA-pinned to current main commit

🤖 Generated with Claude Code

In general, the fix is to explicitly set GitHub Actions permissions for the GITHUB_TOKEN at the least level required. Since this workflow only triggers on pull request events and delegates its work to a reusable workflow, a safe minimal starting point is to set contents: read at the workflow root level, which restricts the token while still allowing typical read operations needed for checks. If the reusable workflow needs broader permissions, those can be added later; starting with read-only is aligned with the recommendation you provided.

Concretely, in .github/workflows/check-semantic-pr.yml, add a top-level permissions: block between the on: block and the jobs: block. This block will then apply to all jobs that do not specify their own permissions, including jobs.check. No imports or extra definitions are needed, as this is purely a YAML configuration change. The rest of the workflow (the uses: reference to the reusable workflow and triggers) remains unchanged.