fix(NoTicket): harden CI checkouts and workflow permissions

[lorenzhs]

Remove unused branch inputs and checkout ref overrides from code checks, unit tests, and security scans so each workflow checks out its triggering commit. Disable persisted checkout credentials and deny Actions cache access for code checks to address the cache-poisoning finding.

Declare explicit read-only token defaults across all workflows, retaining job-specific permissions for documentation and release publishing, integration-test status reporting, and SonarCloud PR reads. Include the necessary permissions on reusable-workflow callers.

Two commits address the two alert families separately:

• Cache poisoning (27)
• Missing workflow permissions (34)

Validation: pre-commit and reusable-workflow permission-chain checks passed. Actionlint passed with the documented cache-mode key excluded because actionlint does not support it yet, and four pre-existing undeclared Core secret references excluded.

---

Note

Low Risk
Changes are limited to GitHub Actions YAML; they reduce token scope and checkout risk without modifying SDK runtime code.

Overview
Hardens GitHub Actions in response to code-scanning findings on cache poisoning and missing workflow permissions.

Reusable workflows (code-check, unit-tests, security-scan) no longer accept a branch input or override checkout ref, so jobs always build the triggering commit. Checkouts in those paths set persist-credentials: false, and the code-quality job sets cache-mode: none to limit cache-related exposure.

Workflows now declare a default permissions: contents: read, with narrower job-level grants where needed (e.g. contents: write for docs build and release publish, statuses: write for integration-test reporting, pull-requests: read for security scans). Caller workflows pass explicit permissions into reusable security-scan and integration-test jobs so the permission chain stays valid.

^{Reviewed by Cursor Bugbot for commit dbc1272. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
90.9% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[lorenzhs]

integration test run: https://github.com/firebolt-db/firebolt-python-sdk/actions/runs/37619853458

[lorenzhs]

Nightly CI: https://github.com/firebolt-db/firebolt-python-sdk/actions/runs/37619917435