Harden GitHub Actions permissions and dependency pinning

[Widthdom]

CLOSES #222

Summary

• pin every third-party GitHub Action to an immutable full commit SHA with an adjacent version comment
• pin DocFX and dotnet-ildasm installations to exact versions
• split mutation comments, benchmark publishing, and CodeQL uploads into trusted-event jobs with minimum write permissions
• keep fork pull requests on read-only analysis paths and add regression tests for workflow hardening and Dependabot coverage

Verification

• dotnet test FolderDiffIL4DotNet.Tests/FolderDiffIL4DotNet.Tests.csproj --configuration Release --nologo (2,042 passed, 1 expected skip)
• dotnet format FolderDiffIL4DotNet.sln --verify-no-changes --no-restore --verbosity minimal
• npm run test:js (184 passed)
• parsed all changed workflow YAML files successfully
• git diff --check
• adversarial review: no actionable correctness findings