build config: more triggers, read-only perms, readability

Signed-off-by: Alex T <alext.mkrs@gmail.com>

Author: alext-mkrs

.github/workflows/build.yaml

@@ -1,5 +1,15 @@
 name: Build
-on: [push]
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
 jobs:
   Build:
     strategy:
@@ -12,14 +22,16 @@ jobs:
             runs_on: ubuntu-24.04-arm
     runs-on: ${{ matrix.runs_on }}
     steps:
-      - uses: actions/checkout@v5
-      - name: Install depdencies.
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+
+      - name: Install dependencies
         run: |
           sudo apt-get update
           sudo apt-get install -y cmake ninja-build build-essential python3-dev libnode-dev swig libjson-c-dev git libgtest-dev
+
       - name: Build
         run: |
           mkdir build
           cd build
           cmake -G Ninja -DBUILDSWIGNODE=on ../
-          ninja
+          ninja