ci: improve cifuzz workflow

[joshuasing]

Update the CIFuzz workflow:

• Pin google/oss-fuzz actions to commit hash (google/oss-fuzz@1b73904, last commit to modify https://github.com/google/oss-fuzz/tree/master/infra/cifuzz/actions)
• Tidy up workflow, restrict token permissions to security-events: write
• Upload SARIF output from run_fuzzers (matches example here: https://google.github.io/oss-fuzz/getting-started/continuous-integration/)

[joshuasing]

The CIFuzz example on https://google.github.io/oss-fuzz/getting-started/continuous-integration/ suggests running on pull_request - currently we're using workflow_dispatch (manual). Do we want to potentially add a schedule to run this, or was it made manual for a reason?

[botovq]

This was changed in 477e8e1 because it kept failing. Does this work again?

The changes look good at a first glance. I'll review this and #1247 in detail after sleep.

[botovq]

I'm gonna land this. We can make further tweaks on top.