Harden actions

[Rob-Hague]

There is a lot of discussion about supply chain security and package compromise at the moment. This updates some of the yml in that respect:

• Pin remaining actions
• Specify top-level/default permissions: contents: read in build.yml
• Set persist-credentials: false on checkout
• Add an environment for nuget publish job and use release event trigger
• Add dependabot cooldown

These recommendations were generated by https://github.com/zizmorcore/zizmor and AI review

[Copilot]

Pull request overview

Hardens the repository’s GitHub Actions and Dependabot configuration to reduce supply-chain risk (action pinning, least-privilege tokens, and safer publish flows).

Changes:

• Pin GitHub Actions to commit SHAs, update runners, and disable persist-credentials on checkout.
• Add default permissions: contents: read in build.yml, and adjust triggers to include release publishing with an environment gate.
• Add Dependabot cooldown windows to reduce update churn.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
.github/workflows/docs.yml	Pins actions, switches runner to Ubuntu 24.04, and disables persisted checkout credentials for docs deploy.
.github/workflows/build.yml	Pins actions, applies top-level minimal permissions, disables persisted checkout credentials, and changes publish triggering to release-based with an environment.
.github/dependabot.yml	Adds cooldown configuration to Dependabot update entries.

Comments suppressed due to low confidence (1)

.github/dependabot.yml:23

• The ignore block no longer includes Microsoft.Bcl.AsyncInterfaces, but the PR description only mentions cooldowns/hardening and the inline comment says to see justifications in Directory.Packages.props. If this removal is unintended, re-add the ignore entry (or update the PR description/justification to explain why it’s no longer needed).

    ignore: # See justifications in Directory.Packages.props
      - dependency-name: "System.Formats.Asn1"
        update-types: ["version-update:semver-major"]
      
      - dependency-name: "Microsoft.Extensions.Logging.Abstractions"