v2023.4
ci: Work around GH actions `container:` + git + security bug
workflows: limit permissions to reading repo contents
cargo: bump minimum Rust version to 1.63
CI: Build with composefs on some versions