chore: Fix zizmor security issues in GHA workflows

[alexandear]

This PR improves the security of our GitHub Actions workflows.

I use zizmor to detect issues.

Changes:

• Add persist-credentials: false to all actions/checkout steps to prevent credential leakage.
• Add cooldown: default-days: 7 to all Dependabot update entries to reduce PR noise.

[gmlewis]

Thank you, @alexandear!
LGTM.
Merging.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.48%. Comparing base (4eb6c2c) to head (3b528bd).

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #4259   +/-   ##
=======================================
  Coverage   97.48%   97.48%           
=======================================
  Files         191      191           
  Lines       19206    19206           
=======================================
  Hits        18723    18723           
  Misses        268      268           
  Partials      215      215           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.