Update sync.yaml

Add permissions, pin the SHA of the third party action

Author: dangoor

.github/workflows/sync.yaml

@@ -1,5 +1,8 @@
 name: 'Upstream Sync'
 
+permissions:
+  contents: write
+
 on:
   schedule:
     - cron:  '0 21 * * 1-6'
@@ -25,7 +28,7 @@ jobs:
     # Step 2: run the sync action
     - name: Sync upstream changes
       id: sync
-      uses: aormsby/Fork-Sync-With-Upstream-action@v3.4
+      uses: aormsby/Fork-Sync-With-Upstream-action@1090e365224fc834e7e1de521c417ded2d6fcb53
       with:
         target_sync_branch: master
         # REQUIRED 'target_repo_token' exactly like this!