ci: github actions hardening

[mmcloughlin]

Following advice in briansmith/untrusted#50.

[codecov-commenter]

Codecov Report

Merging #91 (63d4c3f) into master (0d18240) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##           master      #91   +/-   ##
=======================================
  Coverage   72.25%   72.25%           
=======================================
  Files          28       28           
  Lines        1128     1128           
=======================================
  Hits          815      815           
  Misses        253      253           
  Partials       60       60           

Flag	Coverage Δ
unittests	72.25% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

---

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update 0d18240...63d4c3f. Read the comment docs.