Add explicit top-level permissions block to all GitHub Actions workflow
files, limiting the GITHUB_TOKEN to the minimum required scope: read.

Why this is recommended:
GitHub Actions grants the GITHUB_TOKEN broad default permissions
(read/write on most scopes) unless explicitly restricted. The GitHub
security hardening guide and CodeQL
(actions/missing-workflow-permissions rule) recommend always declaring
an explicit permissions block to enforce the principle of least
privilege.

Threats prevented:
- Compromised or malicious third-party actions (supply chain attacks)
  cannot use the implicit GITHUB_TOKEN to write to the repository,
  create releases, modify issues/PRs, upload packages, or affect
  deployments - even if such an action is injected into the workflow.
- If a vulnerability in a workflow step allows code execution (e.g. via
  script injection through PR title/body), the attacker's ability to
  abuse the token is limited to read-only repository access.
- Reduces blast radius of any accidental or intentional misuse of the
  token across all CI jobs.

Affected workflows: build_all, codestyle, daily-tests, ipc_fuzzer,
llext, pull-request, repro-build, rimage, sof-docs, sparse-zephyr,
testbench, tools, unit-tests, zephyr.

Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>

Replace the mutable tag reference 'msys2/setup-msys2@v2' with a pinned
commit SHA in zephyr.yml.

Why this is recommended:
Tags in GitHub Actions are mutable - a repository owner can silently
move a tag (e.g. 'v2') to point to a different, potentially malicious
commit at any time without the consuming workflow receiving any
notification. Pinning to a full commit SHA ensures the exact code that
was reviewed is what runs in CI, making the reference immutable.

Threats prevented:
- Supply chain attacks: a compromised or malicious actor with write
  access to the msys2/setup-msys2 repository cannot push new code under
  the existing 'v2' tag and have it automatically executed in our CI
  without an explicit code review and hash update on our side.
- Dependency confusion: prevents accidental or forced resolution to an
  unintended version of the action.

The comment '# v2' is retained to make it clear which upstream release
the hash corresponds to, aiding future maintenance when a deliberate
update is needed.

Signed-off-by: Tomasz Leman <tomasz.m.leman@intel.com>