ci: pass shared workflows only the secrets they read (#442)

Author: BryanFRD

.github/workflows/release.yml

@@ -28,4 +28,5 @@ jobs:
     uses: FerrLabs/.github/.github/workflows/reusable-ferrflow-release.yml@b6a08e6055076c18cfa7b8f80c9925275ed407fe # main
     with:
       dry-run: ${{ inputs.dry_run || false }}
-    secrets: inherit
+    secrets:
+      TAG_SIGNING_KEY: ${{ secrets.TAG_SIGNING_KEY }}

.github/workflows/scorecard.yml

@@ -45,6 +45,6 @@ jobs:
           retention-days: 5
 
       - name: Upload to code scanning
-        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4
+        uses: github/codeql-action/upload-sarif@b96794f015dfd88f77b49b1c93e0fa7110f94c63 # v4.38.0
         with:
           sarif_file: results.sarif

.github/workflows/security-scan.yml

@@ -20,4 +20,3 @@ jobs:
       contents: read
       security-events: write
     uses: FerrLabs/.github/.github/workflows/reusable-security-scan.yml@b6a08e6055076c18cfa7b8f80c9925275ed407fe # main
-    secrets: inherit

.github/workflows/sonarqube.yml

@@ -61,7 +61,7 @@ jobs:
           key: ${{ runner.os }}-cargo-cov-${{ hashFiles('Cargo.lock') }}
           restore-keys: ${{ runner.os }}-cargo-cov-
 
-      - uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2
+      - uses: taiki-e/install-action@67729d5c413db75907f0ad1e39bb04b9c868ff60 # v2.85.7
         with:
           tool: cargo-llvm-cov
 
@@ -139,4 +139,5 @@ jobs:
         -Dsonar.coverage.exclusions=site/**
         -Dsonar.tests=.
         -Dsonar.test.inclusions=**/tests.rs,**/tests/**
-    secrets: inherit
+    secrets:
+      SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }}