ci: github actions hardening

[mmcloughlin]

Following advice in briansmith/untrusted#50.

[codecov-commenter]

Codecov Report

Merging #190 (7484227) into master (ec9535c) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master     #190   +/-   ##
=======================================
  Coverage   79.50%   79.50%           
=======================================
  Files          56       56           
  Lines       30922    30922           
=======================================
  Hits        24584    24584           
  Misses       6192     6192           
  Partials      146      146           

Flag	Coverage Δ
integration	7.45% <ø> (ø)
unittests	77.67% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update ec9535c...7484227. Read the comment docs.