Pin and update GitHub Actions in the deploy workflow #111

.github/workflows/deploy.yml uses 10up/action-wordpress-plugin-deploy@stable (a mutable tag), actions/checkout@v2 and the archived actions/upload-release-asset@v1, and the job has access to the WordPress.org SVN credentials. Pin third-party actions to commit SHAs, update checkout, replace the archived upload action, and set least-privilege permissions on the job. codeql-analysis.yml also uses the deprecated v1 CodeQL actions.