matchhostfsowner

Bump version to 1.0.3, tighten CodeQL workflow permissions

Harden checkout action

Allow pull requests to trigger the Test workflow

Fix supressing false-positive CodeQL warnings; fail CI when CodeQL has findings

Generate SBOMs during release