Add explicit workflow permissions and pin Alpine package versions in Dockerfiles

[ehsanking]

Motivation

• Introduce explicit minimal permissions for GitHub Actions workflows to follow least-privilege practice and allow workflows to read repository contents.
• Improve reproducibility and runtime stability of container builds by pinning Alpine package versions in Dockerfile and Dockerfile.prod.
• Ensure the Defender workflow has the required job-level permissions for uploading results and reporting security events.

Description

• Added top-level permissions: contents: read to codeql.yml, defender-for-devops.yml, docker-image.yml, and npm-publish-github-packages.yml, and added job-level permissions (contents: read, security-events: write, actions: read) to the MSDO job in defender-for-devops.yml.
• Updated Dockerfile and Dockerfile.prod to pin Alpine packages using globs (e.g. openssl=3.*, libc6-compat=1.*) and added pinned wget and su-exec where required, converting apk add invocations to a multi-line form.
• Retained existing CodeQL job-level permissions and ensured security-events: write and packages: read remain present where needed.

Testing

• No automated tests were executed as part of this change.

---

Codex Task

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.