main
workflows: Set persist-credentials: false for actions/checkout.
workflows: Upgrade and pin GitHub actions.
workflows: Enable zizmor scanning.