ci: update permissions; remove credentials

[Fdawgs]

This PR:

• Removes Git credentials after checkout as a security precaution by setting persist-credentials to false. They are not used after the initial checkout, and this stops them from accidentally leaking through a script; see related GitHub security post and related actions/checkout issue
• Declares the minimum permissions for the workflows to run at the workflow level in feature.yaml and at the job level in main.yaml, following principle of least privilege; see related GitHub security post