audit workflows via zizmor and correct use of env variables

[mattip]

Recently there was a hack of a repo that used environment variables unsafely. While this repo "only" publishes documentation, it is better to tighten things up where possible. There is a tool called zizmor that can be used to audit workflows, I used it to develop this PR:

• use [persist-credentials: false] in the checkout step, see Remove persist-credentials or change the default to false actions/checkout#485
• use quoted environment variables instead of directly using user-provided values in scripts

[netlify]

✅ Deploy Preview for numpy-org ready!

Name	Link
🔨 Latest commit	ab458d1
🔍 Latest deploy log	https://app.netlify.com/sites/numpy-org/deploys/67554d00c31fca0008273f20
😎 Deploy Preview	https://deploy-preview-797--numpy-org.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

---

To edit notification comments on pull requests, go to your Netlify site configuration.

[rgommers]

This all LGTM, in it goes. zizmor looks like a potentially useful tool. Thanks @mattip