workflows: address zizmor findings

[woodruffw]

Summary

Addresses a handful of findings identified by zizmor: https://github.com/woodruffw/zizmor

cc @jku

Release Note

No functional changes.

Documentation

No functional changes.

[woodruffw]

NB: I set persist-credentials: false everywhere, since I think none of the workflows need to run git push. But if I missed something, some of those may need to be changed to persist-credentials: true.

Edit: NB 2: I also didn't add a zizmor.yml or similar workflow to run zizmor continuously. If that's of interest, I'd be happy to add one similar to the ones in Warehouse and Homebrew's CI/CD setups.

[kommendorkapten]

Thank you, nice work.

[kommendorkapten]

I think I was too fast with the approval :)

[kommendorkapten]

This would need to be replicated to all jobs in this file, as they all will request an id-token to use the ephemeral key flow to sign.

[woodruffw]

Whoops, thanks for catching that! I missed that there were other individual jobs that did signing. Will fix now.

[woodruffw]

Done -- FWICT only two other jobs do signing, so I added it to each.

[kommendorkapten]

I will carry over all findings to root-signing-staging too, so we can first test them there (just to be sure).

edit: spelling error