ci: harden CMake workflow execution

[Alb3e3]

Summary

• restrict GITHUB_TOKEN to read-only contents
• pin actions/checkout v3 to its verified commit
• pass the generated build directory through step environments before using it in shell commands

This keeps the workflow behavior unchanged while satisfying the mandatory GitHub Actions checks for this repository.

Validation

• YAML parse
• zizmor 1.25.2 with strict collection and medium confidence: no findings
• git diff --check

[vitalybuka]

satisfying the mandatory GitHub Actions checks for this repository.

Can you please clarify why this PR is needed, e.g. what is "mandatory GitHub Actions checks"?

[Alb3e3]

Thanks for asking. By “mandatory GitHub Actions checks,” I meant the repository’s required GitHub Actions Scan workflow, not the CMake build matrix.

On the original version of this file, the scan reported four blocking findings in .github/workflows/cmake-multi-platform.yml:

• template-injection on the three steps.strings.outputs.build-output-dir interpolations in the CMake, Build, and Test commands
• unpinned-uses for actions/checkout@v3

The scan output is here: https://github.com/google/libprotobuf-mutator/actions/runs/34440003668

This PR fixes those findings by passing the directory through the step environment, quoting it in the shell commands, and pinning checkout to a commit. It also limits the job token to contents: read. The build matrix and commands are otherwise unchanged.

If this scan is not intended to gate the repository, I can close the PR.

[vitalybuka]

I don't have much experience with actions, so I need to do some research to review.

So in the main description could you add to each changed item explanation WHY?

I'd prefer to keep separate changed to separate PRs, leaving it up to you if you want to split.