fix: restrict e2e workflow token and validate dispatch SHAs

[tim123abc]

Summary

• Pin e2e GitHub Actions jobs to contents: read + statuses: write so repository_dispatch from an authorized fork preview cannot run with contents: write.
• Validate client_payload.git.sha against first-party branches/tags before checkout, drop secrets: inherit, and disable persisted checkout credentials.
• Follow-up still required after merge: rotate DEPLOYMENT_PROTECTION_BYPASS and FLAGS_SECRET in GitHub and Vercel.

Test plan

• Merge to main (dispatch workflows only pick up this change from the default branch)
• Confirm a same-repo preview or workflow_dispatch still runs e2e and posts commit statuses
• Confirm a fork preview dispatch fails at "Validate deployment SHA" and does not check out untrusted code
• Rotate DEPLOYMENT_PROTECTION_BYPASS and FLAGS_SECRET

[vercel]

Your Vercel team microfrontends-vtest314 is not permitted to deploy from this git repository. Contact an administrator to add github organization vercel as a Protected Git Scope in microfrontends-vtest314 on Vercel. Once added, commit again to see your changes.

Learn more: https://vercel.com/docs/security/protected-git-scopes