[StepSecurity] ci: Harden GitHub Actions (#173)

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

.github/workflows/go.yml

@@ -1,13 +1,16 @@
 name: Go
 on: [push, pull_request]
+permissions:
+  contents: read
+
 jobs:
 
   build:
     name: Build
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
-    - uses: actions/setup-go@v5
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
       with:
         go-version: 'stable'