v2023.5
ci: Work around GH actions `container:` + git + security bug
workflows: limit permissions to reading repo contents
cargo: bump minimum Rust version to 1.63
ci: Add "it compiles" coverage for --with-static-compiler