Add Permissions to Workflows and Pin Unpinned Tags for Non-Immutable Actions

[Yuyuutsu]

What is the context of this PR?

Code Scanning has been enabled in some of our Github Repositories is highlighting issues.
This PR resolves these issues:

• Workflow does not contain permissions
• Unpinned tag for a non-immutable Action in workflow

Full server-side request forgery ERROR has not been resolved as the error seems like a false possitive. The solution given by Github would not work for Validator. We can flag this error as a Won't Fix orFalse Positive OR we can look into resolving this error if we think this is an actual error.

Leave a comment on this PR to decide what we want to do with this error.

How to review

Check changes resolve CodeQL Scanning Errors

Checklist

• eq-translations updated to support any new schema keys which need translation

[berroar]

Had a more in depth look at the issue flagged for: Full server-side request forgery, and I do think we should be handling this.

I know we spoke about it at tech session previously, but I didn't realise that it only applies to the validate_schema_from_url method/endpoint. So I think we should add some logic to ensure that any schema being validated either comes from an ONSDigital repo or a Github gist? I'm not sure there are any other use cases for this that would mean that we need to add any other domains, but would resolve this for the time being.