chore: run zizmor on workflows and fix issues - #366

I ran zizmor . and had an agent work through the changes. The changes included,

• SHA pinning
• Removing template injection risks
• Minimizing permissions and scoping to just needed
• Removing some caching, leaving other caching in place since it's guarded reasonably well
• Adding persist_credentials: false to actions/checkout steps
• Switching on pull_request_target workflow to pull_request which runs with lesser permissions