fix: fixed the token-permission and pinned dependencies issue

[harshitasao]

Ⅰ. Describe what this PR does

Fixed the token-permission and pinned dependencies issue reported by scorecard.

Ⅱ. Does this pull request fix one issue?

Part of #1706

Ⅲ. Describe how to verify it

Ⅳ. Special notes for reviews

[codecov]

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 48.84%. Comparing base (0d0031a) to head (fc4befe).
Report is 70 commits behind head on master.

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #1707      +/-   ##
==========================================
+ Coverage   47.91%   48.84%   +0.93%     
==========================================
  Files         162      188      +26     
  Lines       23491    19289    -4202     
==========================================
- Hits        11256     9422    -1834     
+ Misses      11014     8636    -2378     
- Partials     1221     1231      +10     

Flag	Coverage Δ
unittests	48.84% <ø> (+0.93%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[furykerry]

@harshitasao thanks for your effort to find detailed hash for each dependency

/lgtm
/approve

[kruise-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: furykerry

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [furykerry]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment