ci: address zizmor's findings

[woodruffw]

This addresses a bunch of low-impact findings from zizmor, all of which are disabling unneeded credential persistence or moving permissions: stanzas into their dependent jobs.

NB: This changeset doesn't include a new workflow for zizmor, but if folks are interested this one should be drag-n-drop 🙂

Afterwards:

$ zizmor .
🌈 completed codeql.yml
🌈 completed golangci-lint.yml
🌈 completed verify_license.yml
🌈 completed depsreview.yml
🌈 completed build.yml
🌈 completed scorecard.yml
🌈 completed conformance.yml
No findings to report. Good job!

[codysoyland]

Very cool, thanks @woodruffw