Harden the github workflows

Hello,

I am working on a tool and it is currently flagging upx as the next likely candidate for a large supply-chain attack (think like trivy).

upx releases do not include hashes. Most people including myself, just curl and chmod without any verification.

upx github workflows lack any hardening measures. Please run a tool like zizmor to find all the issues.

• unpinned shas
• uses default permissions
• uses unpinned third-party actions such as maxim-lobanov/setup-xcode@v1 and ilammy/msvc-dev-cmd@v1