chore: pin and update all workflow dependencies; add permission scopes (#2138)

---------

Signed-off-by: Christopher Phillips <christopher.phillips@anchore.com>

test/install/environments/Dockerfile-alpine-3.6

@@ -1,2 +1,2 @@
-FROM alpine:3.6
-RUN apk update && apk add python3 wget unzip make ca-certificates
+FROM alpine:3.6@sha256:66790a2b79e1ea3e1dabac43990c54aca5d1ddf268d9a5a0285e4167c8b24475
+RUN apk update && apk add python3 wget unzip make ca-certificates

test/install/environments/Dockerfile-ubuntu-20.04

@@ -1,2 +1,2 @@
-FROM ubuntu:20.04
-RUN apt update -y && apt install make python3 curl unzip -y
+FROM ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
+RUN apt update -y && apt install make python3 curl unzip -y

test/integration/test-fixtures/image-distro-id/Dockerfile

@@ -1,3 +1,3 @@
-FROM busybox:1.31.1
+FROM busybox:1.31.1@sha256:95cf004f559831017cdf4628aaf1bb30133677be8702a8c5f2994629f637a209
 
 

test/integration/test-fixtures/image-go-bin-arch-coverage/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:latest as builder
+FROM golang:1.21.1@sha256:cffaba795c36f07e372c7191b35ceaae114d74c31c3763d442982e3a4df3b39e as builder
 WORKDIR /app
 COPY go.sum go.mod app.go ./
 

test/integration/test-fixtures/image-java-no-main-package/Dockerfile

@@ -1,4 +1,4 @@
-FROM jenkins/jenkins:2.346.3-slim-jdk17
+FROM jenkins/jenkins:2.346.3-slim-jdk17@sha256:028fbbd9112c60ed086f5197fcba71992317864d27644e5949cf9c52ff4b65f0
 
 USER root
 

test/integration/test-fixtures/image-java-virtualpath-regression/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:latest
+FROM alpine:3.18.3@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcff20d3a4a54ba44a
 
 RUN wget https://repo1.maven.org/maven2/org/jvnet/hudson/main/hudson-war/2.2.1/hudson-war-2.2.1.war
 

test/integration/test-fixtures/image-os-binary-overlap/Dockerfile

@@ -1,4 +1,4 @@
-FROM alpine:latest
+FROM alpine:3.18.3@sha256:7144f7bab3d4c2648d7e59409f15ec52a18006a128c733fcff20d3a4a54ba44a
 
 # syft should not longer show the binary package for this image:
 # https://github.com/anchore/syft/issues/931

test/integration/test-fixtures/image-owning-package/Dockerfile

@@ -1,3 +1,3 @@
-FROM ubuntu:20.04
+FROM ubuntu:20.04@sha256:33a5cc25d22c45900796a1aca487ad7a7cb09f09ea00b779e3b2026b4fc2faba
 # this covers rpm-python
-RUN apt-get update && apt-get install -y python-pil=6.2.1-3
+RUN apt-get update && apt-get install -y python-pil=6.2.1-3

test/integration/test-fixtures/image-photon-all-layers/Dockerfile

@@ -1 +1 @@
-FROM photon:5.0-20230729
+FROM photon:5.0-20230729@sha256:4cf2a1ce0a3f4625f13a0becb6b9bccfdb014c565be6e9a2ec4c4aad1ff8a5d9

test/integration/test-fixtures/image-rust-auditable/Dockerfile

@@ -1,2 +1,2 @@
 # An image containing the example hello-auditable binary from https://github.com/Shnatsel/rust-audit/tree/master/hello-auditable
-FROM docker.io/tofay/hello-rust-auditable:latest
+FROM docker.io/tofay/hello-rust-auditable@sha256:1d35d1e007180b3f7500aae5e27560697909132ca9a6d480c4c825534c1c47a9

test/integration/test-fixtures/image-suse-all-layers/Dockerfile

@@ -1,2 +1,2 @@
-FROM registry.suse.com/suse/sle15:15.3.17.20.20
+FROM registry.suse.com/suse/sle15:15.3.17.20.20@sha256:fd657ecbab5ca564d6933e887f6ae8542a9398e6a4b399f352ce10c3a24afc64
 RUN zypper in -y wget

test/integration/test-fixtures/image-vertical-package-dups/Dockerfile

@@ -1,6 +1,6 @@
-FROM centos:7.9.2009
+FROM centos:7.9.2009@sha256:be65f488b7764ad3638f236b7b515b3678369a5124c47b8d32916d6487418ea4
 # modifying the RPM DB multiple times will result in duplicate packages when using all-layers (if there was no de-dup logic)
 # curl is tricky, it already exists in the image and is being upgraded
 RUN yum install -y wget-1.14-18.el7_6.1 curl-7.29.0-59.el7_9.1
 RUN yum install -y vsftpd-3.0.2-29.el7_9
-RUN yum install -y httpd-2.4.6-97.el7.centos.5
+RUN yum install -y httpd-2.4.6-97.el7.centos.5