Consider running Step Security on your repo

StepSecurity automatically generates a pull request that adds several hardening measures to your repo. Run it [here](https://app.stepsecurity.io/securerepo).

By default, the process will create one composite PR that makes multiple changes. I recommend running it several times to create separate PRs for each feature.

The changes it makes include:
1. dependabot - registers the repo with a GitHub service that subsequently submits PRs to upgrade to new releases of workflow actions. An example OpenEXR PR is [here](https://github.com/AcademySoftwareFoundation/openexr/pull/1807).
2. Set workflow permissions to read at the top level, and enable write permissions only on the steps that require it.
3. Pin workflow releases to explicit SHA values rather than named releases.
4. Adds a "Harden Runner" step that monitors CI jobs, although note that this does not work with the current release of the ASWF images, don't enable this for any workflow that uses the prebuilt images.

Comienza con la herramienta StepSecurity Secure Repo enlazada y revisa los cambios generados para este repositorio. Se considera completado cuando las medidas de hardening se separen en pull requests distintos cuando sea práctico: registro de Dependabot, permisos de los workflows, SHAs de las acciones fijados y Harden Runner solo donde sea compatible con las imágenes de ASWF.

Escrito por el modelo de indexación a partir del texto del issue.