ci: address zizmor findings (scope permissions, repin checkout, use pull_request trigger)

Author: wangauone

.github/workflows/mirror-changelog.yml

@@ -15,7 +15,7 @@
 name: Mirror Toolbox Changelog
 
 on:
-  pull_request_target:
+  pull_request:
     types: [opened, edited]
 
 jobs:

.github/workflows/presubmit-tests.yml

@@ -20,9 +20,11 @@ on:
 jobs:
   run-presubmit-tests:
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
     steps:
       - name: Check out code
-        uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Install Gemini CLI
         run: npm install @google/gemini-cli