chore(ci): address zizmor findings

This is part 1 of N. The main focus in this PR
is on unpinned references and inadvertent/unnecessary
credential persistence.

Signed-off-by: William Woodruff <william@astral.sh>