CI: Address zizmor warnings and bump deps

.github/workflows/nifi_migrate_pr.yaml

@@ -14,11 +14,15 @@ on:
 env:
   RUST_VERSION: 1.87.0
 
+permissions: {}
+
 jobs:
   # This job is always run to ensure we don't miss any new upstream advisories
   cargo-deny:
     name: Run cargo-deny
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     # Prevent sudden announcement of a new advisory from failing CI
     continue-on-error: ${{ matrix.checks == 'advisories' }}
     strategy:
@@ -28,19 +32,21 @@ jobs:
           - bans licenses sources
     steps:
       - name: Checkout Repository
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
       - name: Run cargo-deny
-        uses: EmbarkStudios/cargo-deny-action@f2ba7abc2abebaf185c833c3961145a3c275caad # v2.0.13
+        uses: EmbarkStudios/cargo-deny-action@3c6349835b2b7b196a839186cb8b78e02f7b5f25 # v2.1.1
         with:
           command: check ${{ matrix.checks }}
 
   build:
     name: Build nifi-migrate
     needs:
       - cargo-deny
+    permissions:
+      contents: read
     strategy:
       fail-fast: false
       matrix:
@@ -52,11 +58,11 @@ jobs:
     runs-on: ${{ matrix.targets.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.targets.target }}

.github/workflows/nifi_migrate_release.yaml

@@ -11,20 +11,26 @@ on:
 env:
   RUST_VERSION: 1.87.0
 
+permissions: {}
+
 jobs:
   create-release:
     name: Create Draft Release
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # required to create the draft release
     steps:
       - name: Create Draft Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
 
   build:
     name: Build nifi-migrate
     needs:
       - create-release
+    permissions:
+      contents: write # required to upload release assets
     strategy:
       fail-fast: false
       matrix:
@@ -36,11 +42,11 @@ jobs:
     runs-on: ${{ matrix.targets.os }}
     steps:
       - name: Checkout
-        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: ${{ env.RUST_VERSION }}
           targets: ${{ matrix.targets.target }}
@@ -57,7 +63,7 @@ jobs:
         run: mv target/${{ matrix.targets.target }}/release/nifi-migrate.exe nifi-migrate-${{ matrix.targets.target }}.exe
 
       - name: Upload Artifact to Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: true
           files: nifi-migrate-${{ matrix.targets.target }}${{ runner.os == 'Windows' && '.exe' || '' }}
@@ -67,8 +73,10 @@ jobs:
     needs:
       - build
     runs-on: ubuntu-latest
+    permissions:
+      contents: write # required to publish the release
     steps:
       - name: Publish Release
-        uses: softprops/action-gh-release@72f2c25fcb47643c292f7107632f7a47c1df5cd8 # v2.3.2
+        uses: softprops/action-gh-release@3d0d9888cb7fd7b750713d6e236d1fcb99157228 # v3.0.2
         with:
           draft: false

.github/workflows/pre_commit.yaml

@@ -9,14 +9,18 @@ on:
 env:
   RUST_TOOLCHAIN_VERSION: "1.87.0"
 
+permissions: {}
+
 jobs:
   pre-commit:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
-      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
           fetch-depth: 0
-      - uses: stackabletech/actions/run-pre-commit@9a70678a34ec4e4f6927d0f8842b74aa857a9577 # v0.10.2
+      - uses: stackabletech/actions/run-pre-commit@0fe048f952bee522474903a925ea48dc706a0bb4 # v0.17.5
         with:
           rust: ${{ env.RUST_TOOLCHAIN_VERSION }}