Drop CI permissions, eliminate persisted credentials

[woodruffw]

Description

This follows #4901 with some more CI security improvements. Namely:

• Where possible, the workflow-level default permissions have been fully dropped and job-level permissions are used to limit permissions to the smallest unit of work possible.
• All actions/checkout usage now includes persist-credentials: false to avoid accidental credential persistence/leakage. Some exceptions to this that actually use the persisted credential (e.g. for git push) have persist-credentials: true instead with a comment, making explicit the implicit default.

See zizmor's docs for more info on both of these:

• https://docs.zizmor.sh/audits/#excessive-permissions
• https://docs.zizmor.sh/audits/#artipacked

Checklist - did you ...

• Implement any code style changes under the --preview style, following the
  stability policy?
• Add an entry in CHANGES.md if necessary?
• Add / update tests if necessary?
• Add new / update outdated documentation?

Like with #4901, I believe none of the above apply since this is an internal-only change 🙂

[github-actions]

diff-shades reports zero changes comparing this PR (6068429) to main (23b8127).

---

What is this? | Workflow run | diff-shades documentation

[hauntsaninja]

Thank you!