* Make Github workflows permissions read-only by default * Pins `skx/github-action-publish-binaries` action to specific hash