[CI] Set actions references to specific commit hash, provide explicit top level token permissions for jobs

[AlexanderDokuchaev]

Changes

Token permissions docs: https://github.com/ossf/scorecard/blob/98ec491a888a8a0db9d83a3c7d379ae1f46321de/docs/checks.md#token-permissions
Actions by hash docs: https://github.com/ossf/scorecard/blob/98ec491a888a8a0db9d83a3c7d379ae1f46321de/docs/checks.md#pinned-dependencies

Related tickets

143130

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 47.90%. Comparing base (99b5b85) to head (4cd31de).

Additional details and impacted files

@@           Coverage Diff            @@
##           develop    #2720   +/-   ##
========================================
  Coverage    47.90%   47.90%           
========================================
  Files          486      486           
  Lines        46831    46831           
========================================
  Hits         22434    22434           
  Misses       24397    24397           

Flag	Coverage Δ
COMMON	42.56% <ø> (ø)
ONNX	34.31% <ø> (ø)
OPENVINO	40.81% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
common	69.63% <ø> (ø)
torch	33.19% <ø> (ø)
tensorflow	0.00% <ø> (ø)
onnx	93.05% <ø> (ø)
openvino	94.39% <ø> (ø)
ptq	80.91% <ø> (ø)

[AlexanderDokuchaev]

| 10 / 10 | Token-Permissions 
| 6 / 10  | Pinned-Dependencies | Warn: pipCommand not pinned by hash:

To get 10/10 for Pinned-Dependencies. need to add hashes for all packages