Bring .github settings up-to-date

[nateprewitt]

This PR makes a handful of changes to bring our GHA up to current expectations.

Changes

• Dependencies are now strictly pinned to a commit hash matching the tag they were previously using. This is considered best practice to avoid supply chain attacks on repositories by remapping an existing tag to a new commit.
• CI now runs on all of our supported platforms (Linux, macOS, and Windows).
• Dependabot will now pull in minor+ updates to workflow dependencies to fix any security or notable functionality issues.
• Added CodeQL to run analysis over the repo and flag any potential concerns.
• Permissions were added to both existing and new workflows.
• Rewrote compliance test case harness to run correctly on Windows.

[jamesls]

Thanks! Could you also update the CHANGELOG.rst before merging? It's all done by hand in this repo.

[nateprewitt]

Relevant changelog information for the Python support changes is now added in #337. This isn't external facing so we'll omit a changelog for the GHA updates.