Add zizmor scan action (#79)

.github/workflows/docker-image.yml

@@ -8,13 +8,16 @@ on:
   pull_request:
     types: [opened, synchronize, reopened]
 
+permissions: {}
+
 jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
       with:
         fetch-depth: 0
+        persist-credentials: false
 
     - name: Build the Docker image
       run: docker compose build --no-cache
@@ -35,6 +38,6 @@ jobs:
 
     - name: Sonar scan
       if: env.SONAR_TOKEN != null
-      uses: SonarSource/sonarqube-scan-action@v6
+      uses: SonarSource/sonarqube-scan-action@713881670b6b3676cda39549040e2d88c70d582e # v8.2.0
       env:
         SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}