Secure and pin GitHub Actions workflows in dpsynth and jax_privacy.

[copybara-service]

Secure and pin GitHub Actions workflows in dpsynth and jax_privacy.

This change updates GitHub Actions workflows for dpsynth and jax_privacy to improve security. The zizmor-output action has been failing for a few PRs. (Example: https://github.com/google-deepmind/jax_privacy/actions/runs/31780245287/job/94704345417?pr=358)

Specifically, it:

• Pins actions to specific commit SHAs instead of mutable version tags.
• Restricts default workflow permissions to "contents: read".
• Configures checkout steps with "persist-credentials: false".

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[MuhammadNiazAli]

Looks good pinning actions/checkout to a full commit SHA instead of the v4 tag closes the supply-chain risk of a tag being force-moved or a release being compromised after the fact. Adding persist-credentials: false is also a solid call since this workflow doesn't need to push back to the repo, so there's no reason to leave a token sitting on the runner. The workflow-level permissions: contents: read further locks things down to least-privilege.

No functional concerns the pin still resolves to the same v4 release per the trailing comment. Approving.