chore(ci): clean up pins, constrain permissions#56

facutuesca merged 1 commit intomaintrailofbits/cookiecutter-python:mainfrom

ww/pinacttrailofbits/cookiecutter-python:ww/pinactCopy head branch name to clipboard