Stop using floating Python 3.x in docs and label_pr CI (#16753)

* Stop using floating Python 3.x in docs and label_pr CI

The python-version: '3.x' specifier resolved to Python 3.15.0 on newer
runner images, causing rpds-py to fail to build (no pre-built wheel).
Removing the override lets the setup-python composite action derive the
version from the Makefile, consistent with the rest of CI.


* Fix SonarCloud security findings in docs and label_pr workflows

Pin pip dependencies with --only-binary :all: to prevent execution of
setup scripts, scope write permissions to job level instead of workflow
level, and use full commit SHA for third-party action.


* fix yaml syntax

* update yaml syntax so all run is recongnized correctly

* Add least-privilege permissions to docs workflow


* Disable credential persistence in docs workflow checkout

Prevents tox and dependency code from accessing the GitHub token
stored in .git/config.

Assisted-By: Claude Opus 4.6 <noreply@anthropic.com>

.github/workflows/docs.yml

@@ -7,17 +7,18 @@ jobs:
     name: docsite test build
     runs-on: ubuntu-latest
     timeout-minutes: 30
+    permissions:
+      contents: read
     steps:
       - uses: actions/checkout@v4
         with:
+          persist-credentials: false
           show-progress: false
 
       - uses: ./.github/actions/setup-python
-        with:
-          python-version: '3.x'
 
       - name: install tox
-        run: pip install tox
+        run: 'pip install --only-binary :all: tox==4.67.1'
 
       - name: Assure docs can be built
         run: tox -e docs