fixup: pin version, add perms

Signed-off-by: Todd Baert <[email protected]>

.github/workflows/component-owners.yml

@@ -2,12 +2,17 @@ name: 'Component Owners'
 on:
   pull_request_target:
 
+permissions:
+  contents: read              # to read changed files
+  issues: read|write          # to read/write issue assignees
+  pull-requests: read|write   # to read/write PR reviewers
+
 jobs:
   run_self:
     runs-on: ubuntu-latest
     name: Auto Assign Owners
     steps:
-      - uses: dyladan/component-owners@main
+      - uses: dyladan/component-owners@95fcb98c201ff5a41f6b9df38caad4bf9bf4ef02
         with:
           config-file: .github/component_owners.yml
           repo-token: ${{ secrets.GITHUB_TOKEN }}