Do not persist github actions credentials (#228)

Identified with the help of zizmor (https://github.com/woodruffw/zizmor)

.github/workflows/ci.yml

@@ -142,6 +142,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: ${{ matrix.install_dependencies }}

.github/workflows/docker-image.yml

@@ -66,6 +66,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - uses: docker/setup-buildx-action@v3
 
@@ -169,4 +171,4 @@ jobs:
 
     - name: Inspect Docker image
       run: |
-        docker buildx imagetools inspect ${{ matrix.image }}:${{ steps.metadata.outputs.version }}
+        docker buildx imagetools inspect "${{ matrix.image }}:${{ steps.metadata.outputs.version }}"

.github/workflows/release-artifacts.yml

@@ -45,6 +45,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - name: Install dependencies
       run: ${{ matrix.install_dependencies }}
@@ -105,6 +107,8 @@ jobs:
 
     steps:
     - uses: actions/checkout@v4
+      with:
+        persist-credentials: false
 
     - uses: docker/setup-buildx-action@v3
 

.github/workflows/rust-checks.yml

@@ -36,6 +36,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install system dependencies
         run: |
@@ -74,6 +76,8 @@ jobs:
     steps:
       - name: Checkout code
         uses: actions/checkout@v4
+        with:
+          persist-credentials: false
 
       - name: Install Rust toolchain
         id: install-rust-toolchain