[jokerttu]

Fixes the Medium findings that make the zizmor GitHub Actions Scan fail (exit code 13).

Unpinned actions. Pins every uses: reference in .github/workflows/ to a full commit hash, which the zizmor blanket unpinned-uses policy requires. Each pin carries a # vX.Y.Z comment naming the release it points to.

The three refs that were still on a tag (actions/setup-java@v4, actions/cache/restore@v4, actions/cache/save@v4 in analyze.yaml) now use the same hashes the other workflows already pin for those actions: setup-java v4.9.1 and cache v4.3.0. These three were the mandatory zizmor findings on #795.

Workflow permissions. analyze.yaml and licence-check.yaml had no permissions: block, so they ran with the default token permissions (excessive-permissions). Both now declare contents: read at the top level, the same block test-and-build.yaml already uses. Their jobs only check out code and run local tools; none use the token.

Why it's safe: no action changes major version, and none of the hashes that were already pinned change. The only behavior change is that setup-java and cache in analyze.yaml run fixed releases inside v4 instead of the moving v4 tag.

subosito/flutter-action stays at v2.23.0. It resolves 3.47.x at runtime by prefix match against Flutter's release manifest (setup.sh, filter_by_version), and that manifest lists stable 3.47 releases. bluefireteam/melos-action stays on its existing pin, an untagged commit after v3.0.0, so it has no version comment.

Bumping actions to newer major versions is left to #771.

Pre-launch Checklist

• I read the Contributor Guide and followed the process outlined there for submitting PRs.
• I signed the CLA.
• I listed at least one issue that this PR fixes in the description above.
• I updated/added relevant documentation
• I added new tests to check the change I am making
• All existing and new tests are passing.