Harden lint action

Signed-off-by: Nathan Weinberg <nweinber@redhat.com>

.github/workflows/lint.yml

@@ -33,34 +33,43 @@ jobs:
   lint:
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout
-        uses: actions/checkout@v4
+      - name: "Harden Runner"
+        uses: step-security/harden-runner@17d0e2bd7d51742c71671bd19fa12bdc9d40a3d6 # v2.8.1
+        with:
+          egress-policy: audit # TODO: change to 'egress-policy: block' after couple of runs
+
+      - name: "Checkout"
+        uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
         with:
           # https://github.com/actions/checkout/issues/249
           fetch-depth: 0
           submodules: true
 
       - name: Setup Python 3.11
-        uses: actions/setup-python@v5
+        uses: actions/setup-python@82c7e631bb3cdc910f68e0081d67478d79c6982d # v5.1.0
         with:
           python-version: 3.11
           cache: pip
           cache-dependency-path: |
             **/pyproject.toml
             **/requirements*.txt
+
       - name: Install dependencies
         id: deps
         run: |
           python -m pip install --upgrade pip
           python -m pip install tox
+
       - name: Run Ruff check
         run: |
           tox -e ruff -- check
+
       - name: Run linting
         if: ${{ !cancelled() && (steps.deps.outcome == 'success') }}
         run: |
           echo "::add-matcher::.github/workflows/matchers/pylint.json"
           tox -e lint
+
       - name: Run mypy type checks
         if: ${{ !cancelled() && (steps.deps.outcome == 'success') }}
         run: |