Update workflows and enhance security

[BlackDex]

This commit updates the workflow files and also fixes some security issues which were reported by using zizmor https://github.com/woodruffw/zizmor

[dfunkt]

Haven't had the chance to test these changes yet, just a quick surface look.

[BlackDex]

@dfunkt, i think those items are not correct.
The GitHub documentation also states that you can either provide a global permission, or a per job setting.
But maybe adding a default of not allowing anything is a good option though, to prevent more broader access if someone adds a new job without adding permissions.

[dfunkt]

You can disregard my previous suggestions, completly forgot that I was checking the files with --pedantic enabled.

[BlackDex]

You can disregard my previous suggestions, completly forgot that I was checking the files with --pedantic enabled.

Well, you made me thinking, and having some added security by setting no permissions at all for the whole workflow by default, and then setting it per job is probably a nice way of enforcing it everywhere.

In that case, when forks still have a read-write token by default that is also a bit more hard to exploit there.
Also converted a few other items, and now i get a result of 0 items wrong, also checked with a GitHub Token for some added online checks.

[BlackDex]

I also run these workflows through https://rhysd.github.io/actionlint/ and they are also clean there.

[dimejo]

@BlackDex:
In case you want to further tighten permissions you can run GitHubSecurityLab/actions-permissions to scan and print minimally required permissions per job.

[BlackDex]

@BlackDex: In case you want to further tighten permissions you can run GitHubSecurityLab/actions-permissions to scan and print minimally required permissions per job.

Thanks, that might be a nice thing to add :)