chore: harden supply chain — pin actions, fix template injection, update deps#17

brendanjryan merged 1 commit intomaintempoxyz/lints:mainfrom

georgen/supply-chain-hardeningtempoxyz/lints:georgen/supply-chain-hardeningCopy head branch name to clipboard