Workflow security fixes

[Zeitsperre]

Pull Request Checklist:

• This PR addresses an already opened issue (for bug fixes / features)
  • This PR fixes #xyz
• Tests for the changes have been added (for bug fixes / features)
  • (If applicable) Documentation has been added / updated (for bug fixes / features)
• CHANGELOG.rst has been updated (with summary of main changes)
  • Link to issue (:issue:number) and pull request (:pull:number) has been added

What kind of change does this PR introduce?

• De-escalates the privileges of steps in workflows by restricting credentials
• Reduces the risk of template injection in run steps
• Simplifies the bump-my-version logic

Does this PR introduce a breaking change?

It should not.

Other information:

Changes suggested here were determined from analysis using https://github.com/woodruffw/zizmor

There are a handful of workflows that require pull_request_target triggers. This is insecure since it runs actions in the parent repo that can be influenced by configurations stemming from forks. The only way to fully secure this would be to try using reusable workflows. This would be a medium-effort task, with gains across all Ouranos repositories.

[github-actions]

Note

It appears that this Pull Request modifies the main.yml workflow.

On inspection, the XCLIM_TESTDATA_BRANCH environment variable is set to the most recent tag (v2024.8.23).

No further action is required.