Fixes from zizmor

[agriyakhetarpal]

Description

While repositories that build JupyterLite sites don't serve sensitive files but rather static assets over GitHub Pages/etc., they are still repositories, after all, so this PR updates the deployment workflow with https://github.com/woodruffw/zizmor.

Specifically, I ran uvx zizmor --pedantic .github/workflows/ for this, and used npx pin-github-action to pin the workflows to hashes. At the time, the use of Dependabot has been discussed in #106; however, GitHub Actions versions pinned to hashes should be useful anyway, and shouldn't affect anyone outside site builders/maintainers.

Here are the docs on the rules that were fixed:

• https://woodruffw.github.io/zizmor/audits/#artipacked, which resolves this underlying issue in GitHub Actions: Remove persist-credentials or change the default to false actions/checkout#485
• https://woodruffw.github.io/zizmor/audits/#excessive-permissions

[agriyakhetarpal]

Ah, I didn't realise this was marked as a draft since then; this should be ready to go in. I'll rebase and test it out now!