[LOW] Pin CI actions and keep secrets off pull requests

[OskarEichler]

Summary

• Restrict the workflow token to read-only repository contents.
• Pin actions/checkout and ruby/setup-ruby to the reviewed release commits.
• Disable checkout credential persistence.
• Keep the Coveralls token out of pull-request jobs by uploading coverage only on trusted master pushes.

Security impact

This addresses two low-severity CI trust-boundary issues. A configured Coveralls token could otherwise reach unreviewed same-repository pull-request code, and mutable action references could change without review while running in the workflow's token context.

The latest public master run showed COVERALLS_REPO_TOKEN unset, so the Coveralls path is preventative for future configuration. Fork pull requests do not receive repository secrets. This workflow does not publish the gem or hold RubyGems credentials.

Verification

• Ruby 4.0.6: bundle exec rake — 220 examples, 0 failures; 15 files, no RuboCop offenses.
• Ruby 3.2.11: bundle exec rake — 220 examples, 0 failures; 15 files, no RuboCop offenses.
• Parsed the updated workflow as YAML and ran git diff --check.
• Verified the pinned commits match actions/checkout v7.0.1 and ruby/setup-ruby v1.321.0.

Limitations

• GitHub-hosted CI remains the authority for the full legacy Ruby, JRuby, TruffleRuby, and Windows matrix.
• Development gems remain dynamically resolved to preserve the repository's broad compatibility matrix; this PR does not introduce a shared lockfile.

Breaking changes

None. Pull requests still run the same test matrix; only Coveralls submission is limited to trusted master pushes.