[GH Actions] Add recommended configuration to harden the runner

[DelazJ]

taken from actions outputs.
I don't know what these really do (or if worth it) but this is an old todo so let's solve it...

[qgis-bot]

The backport to release_3.40 failed:

The process '/usr/bin/git' failed with exit code 1

stderr

To https://github.com/qgis/QGIS-Documentation.git
 ! [remote rejected]       backport-9609-to-release_3.40 -> backport-9609-to-release_3.40 (refusing to allow a Personal Access Token to create or update workflow `.github/workflows/auto-label.yml` without `workflow` scope)
error: failed to push some refs to 'https://github.com/qgis/QGIS-Documentation.git'

To backport manually, run these commands in your terminal:

# Fetch latest updates from GitHub
git fetch
# Create a new working tree
git worktree add .worktrees/backport-release_3.40 release_3.40
# Navigate to the new working tree
cd .worktrees/backport-release_3.40
# Create a new branch
git switch --create backport-9609-to-release_3.40
# Cherry-pick the merged commit of this pull request and resolve the conflicts
git cherry-pick a9b0eff213814db184e69c9e4439ce77fed7d9fb
# Push it to GitHub
git push --set-upstream origin backport-9609-to-release_3.40
# Go back to the original working tree
cd ../..
# Delete the working tree
git worktree remove .worktrees/backport-release_3.40

Then, create a pull request where the base branch is release_3.40 and the compare/head branch is backport-9609-to-release_3.40.