Add explicit versions and timeouts to GHA workflows

[mhucka]

This updates the GitHub Actions workflows to conform to some Google requirements and best practices:

• pin versions of GitHub Actions to commit SHAs
• pin versions of runners instead of using *-latest
• set default permissions for workflow
• set timeouts on jobs, to prevent running for 6 hrs (the default) in case of hangs or loops

This also fixes the following Scorecard security warnings:

• https://github.com/quantumlib/Qualtran/security/code-scanning/17
• https://github.com/quantumlib/Qualtran/security/code-scanning/18
• https://github.com/quantumlib/Qualtran/security/code-scanning/20
• https://github.com/quantumlib/Qualtran/security/code-scanning/21
• https://github.com/quantumlib/Qualtran/security/code-scanning/22
• https://github.com/quantumlib/Qualtran/security/code-scanning/23
• https://github.com/quantumlib/Qualtran/security/code-scanning/24
• https://github.com/quantumlib/Qualtran/security/code-scanning/25
• https://github.com/quantumlib/Qualtran/security/code-scanning/26
• https://github.com/quantumlib/Qualtran/security/code-scanning/27
• https://github.com/quantumlib/Qualtran/security/code-scanning/28
• https://github.com/quantumlib/Qualtran/security/code-scanning/29
• https://github.com/quantumlib/Qualtran/security/code-scanning/30
• https://github.com/quantumlib/Qualtran/security/code-scanning/31
• https://github.com/quantumlib/Qualtran/security/code-scanning/32
• https://github.com/quantumlib/Qualtran/security/code-scanning/33
• https://github.com/quantumlib/Qualtran/security/code-scanning/34
• https://github.com/quantumlib/Qualtran/security/code-scanning/35
• https://github.com/quantumlib/Qualtran/security/code-scanning/36
• https://github.com/quantumlib/Qualtran/security/code-scanning/37
• https://github.com/quantumlib/Qualtran/security/code-scanning/38
• https://github.com/quantumlib/Qualtran/security/code-scanning/39