ci: least-privilege token, SHA-pinned actions, cargo audit job

- ci.yml declares permissions: contents: read instead of the default
  token scope.
- Every action is pinned to the commit its current tag points at
  (checkout v4.4.0, upload-artifact v4.6.2, action-gh-release v2.6.2),
  so a moved tag can't change what runs with release write access.
- A cargo audit job runs on every push; the single ignored advisory
  (RUSTSEC-2023-0071, rsa via russh, no fix available) is recorded with
  its rationale in rust/.cargo/audit.toml (SEC-20261012-019, -012).

Release signing and macOS notarisation are not part of this change.

.github/workflows/release-builds.yml

@@ -28,7 +28,7 @@ jobs:
                 shell: bash
                 working-directory: rust
         steps:
-            - uses: actions/checkout@v4
+            - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4.4.0
               with:
                   fetch-depth: 0
 
@@ -51,7 +51,7 @@ jobs:
               run: ./release.sh
 
             - name: Upload artefacts
-              uses: actions/upload-artifact@v4
+              uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2
               with:
                   name: nexus-terminal-${{ matrix.runner }}
                   path: |
@@ -61,6 +61,6 @@ jobs:
 
             - name: Attach to GitHub Release
               if: startsWith(github.ref, 'refs/tags/')
-              uses: softprops/action-gh-release@v2
+              uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2.6.2
               with:
                   files: build/releases/*/NexusTerminal-*.zip