CI: Harden gerrit-verify workflow permissions

Replace 'permissions: read-all' with least-privilege
'contents: read' (Sonar githubactions:S8234). Add
'--only-binary :all:' and pin tox on the ACT-only local
install step to lock resolved versions and prevent setup
script execution (Sonar S8544, S8541).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Change-Id: I46e6b4fc67db5f8c8eb25aaf727bade9aebf618d
Signed-off-by: Anil Belur <abelur@linuxfoundation.org>

Author: askb

.github/workflows/gerrit-verify.yaml

@@ -53,7 +53,8 @@ concurrency:
   group: gerrit-verify-${{ github.ref }}
   cancel-in-progress: true
 
-permissions: read-all
+permissions:
+  contents: read
 
 jobs:
   prepare:
@@ -95,7 +96,8 @@ jobs:
           python-version: '3.x'
       - name: Install tox
         if: ${{ env.ACT == 'true' }}
-        run: pip install --upgrade pip && pip install tox
+        # ponytail: ACT-only local step; tox pinned for S8544, bump manually
+        run: "pip install --only-binary :all: --upgrade pip && pip install --only-binary :all: tox==4.58.0"
       - name: Run docs & linkcheck
         if: ${{ env.ACT == 'true' }}
         run: tox -e docs,docs-linkcheck