ci: set permissions, pin actions, do not persists creds, add `SECURITY.md` #108

	name: build_ci_multi_images
	on:
	pull_request:
	types: [ opened, synchronize, reopened, labeled, unlabeled ]
	branches:
	- main

	permissions: {}

	env:
	REGISTRY_USER: ${{ github.actor }}
	REGISTRY_PASSWORD: ${{ github.token }}
	IMAGE_REGISTRY: ghcr.io/${{ github.repository_owner }}

	jobs:
	build_multi_ci:
	name: ${{ matrix.build.name }}
	runs-on: 'ubuntu-latest'
	permissions:
	contents: read
	packages: write
	strategy:
	fail-fast: false
	matrix:
	install_latest: [ true ]
	steps:
	- name: "login docker hub"
	run: \|
	podman login -u ${{secrets.DOCKER_HUB_USER}} -p ${{secrets.DOCKER_HUB_TOKEN}} docker.io
	docker login -u ${{secrets.DOCKER_HUB_USER}} -p ${{secrets.DOCKER_HUB_TOKEN}}
	- name: "login quay.io"
	run: \|
	podman login -u ${{secrets.QUAY_USER}} -p ${{secrets.QUAY_TOKEN}} quay.io
	docker login -u ${{secrets.QUAY_USER}} -p ${{secrets.QUAY_TOKEN}} quay.io
	- name: Checkout repository
	uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5
	with:
	persist-credentials: false
	- run: \|
	sudo apt-get update
	sudo apt-get -y install qemu-user-static buildah less git make podman clamav clamav-freshclam
	name: 'install dev deps'
	- run: buildah unshare make branch_or_ref=master release_tag=master multibuild
	name: 'build multi image'
	- run: buildah unshare make dist_name=localhost/curl-multi release_tag=master test
	name: 'test image'
	- run: make image_name=localhost/curl-multi:master scan
	name: 'security scan image'

Provide feedback