v1.23.0
CI: add LTO jobs with LLVM 16
CI: set read-all permissions
CI: enable macOS build/tests LLVM 16 job with LTO
CI: switch to LTO=ON for LLVM-16 build