ci: Harden GitHub Actions workflow permissions

Without an explicit declaration, the workflow token carries write
access to the repository on push events, although our project only
needs read access. Restrict the grant to limit what a compromised
action can reach.

Also harden the dependency step: replace context expressions such as
`${{ github.ref }}` with environment variables to prevent expansion
as shell code.

This is a cherry-pick of commit ef395b942d79b46bde4cfc33d30a9bddc0a282a8
from branch 'libpng18'.

Resolves: https://github.com/pnggroup/libpng/pull/879
Reviewed-by: Cosmin Truta <ctruta@gmail.com>
Signed-off-by: Cosmin Truta <ctruta@gmail.com>