chore(ci): pin the actions and scope the token

[LKSNDRTMLKV]

P4/P5/P6 of the check-coverage audit, applied here. Small and mechanical.

Found by tools/check-ci-parity.sh, which reports CI drift across the
repositories — this repo came back with two unpinned actions and no
permissions: block.

What changed

• actions/checkout and actions/setup-node are SHA-pinned. A tag is a
  mutable label; a SHA is not. Both were resolved from the actions' own
  repositories rather than copied from elsewhere, because a SHA pin proves
  immutability, not provenance — the platform does not check that a pinned
  SHA belongs to the repository named beside it, and a SHA from a fork resolves
  just as happily.

• permissions: contents: read at the top. There was no block at all, so
  every job inherited the repository default token scope. Nothing in this
  workflow writes — it checks out, installs, builds, and runs the link, leakage
  and OpenAPI checks.

• concurrency with cancel-in-progress, excluding main. A rebase or a
  follow-up push currently leaves the superseded run going to completion. main
  is excluded deliberately: the post-merge run is the record for that commit.

What did not change

The triggers were already right — push: [main] plus an unfiltered
pull_request — which is worth noting, because the sibling Rust repo had
push: ["**"] alongside pull_request and was running every suite twice. This
repo did not have that bug.

No job logic, no dependency, no build step touched.

Verification

YAML parses; permissions and concurrency present. The build itself is
unchanged, so CI on this PR is the check.

[cloudflare-workers-and-pages]

Deploying odal-node-docs with    Cloudflare Pages

Latest commit:	84cbcf2
Status:	✅  Deploy successful!
Preview URL:	https://05d8a130.odal-node-docs.pages.dev
Branch Preview URL:	https://chore-pin-and-scope-the-work.odal-node-docs.pages.dev

View logs

[cloudflare-workers-and-pages]

Deploying odal-node-landing with    Cloudflare Pages

Latest commit:	84cbcf2
Status:	✅  Deploy successful!
Preview URL:	https://cdd4e2ca.odal-node-landing.pages.dev
Branch Preview URL:	https://chore-pin-and-scope-the-work.odal-node-landing.pages.dev

View logs