workflows: fix artipacked zizmor findings

[p-linnane]

Trying again to fix these. I set persist-credentials: true for any jobs that had git operations, and false for the others. Let me know if I misunderstood.

[Bo98]

Trying again to fix these. I set persist-credentials: true for any jobs that had git operations, and false for the others. Let me know if I misunderstood.

Specifically anything that interacts with a remote (e.g. git push).

A while back I actually got ahead of the game here and by making most workflows in this repo work without any tokens:

• git-user-config just sets a config - no pushing
• setup-commit-signing similar
• git-try-push actually sets up a file:// remote to push now (it previously did just push to GitHub)

So if I did it correctly, you shouldn't need credentials for anything here anymore.